<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_RE刷题 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_RE刷题
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-11-07
      </span>

                                                                        <span class="post-pubtime"> 本文共11.7k字 </span>

                                                                        <span class="post-pubtime">
        大约需要103min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/RE/" title="RE">
            <b>#</b> RE
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>之前写过一部分re的题解，最近又有点想搞re了，重来吧。(从01开始计)</p>
<h1 id="0x01-简单注册器"><a href="#0x01-简单注册器" class="headerlink" title="0x01.简单注册器"></a>0x01.简单注册器</h1><p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211021234037840.png" alt="image-20211021234037840"></p>
<p>简单的替换和翻转字符串</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">x = <span class="string">&quot;dd2940c04462b4dd7c450528835cca15&quot;</span></span><br><span class="line">x = <span class="built_in">list</span>(x)</span><br><span class="line">x[<span class="number">2</span>] = <span class="built_in">chr</span>((<span class="built_in">ord</span>(x[<span class="number">2</span>]) + <span class="built_in">ord</span>(x[<span class="number">3</span>])) - <span class="number">50</span>)</span><br><span class="line">x[<span class="number">4</span>] = <span class="built_in">chr</span>((<span class="built_in">ord</span>(x[<span class="number">2</span>]) + <span class="built_in">ord</span>(x[<span class="number">5</span>])) - <span class="number">48</span>)</span><br><span class="line">x[<span class="number">30</span>] = <span class="built_in">chr</span>((<span class="built_in">ord</span>(x[<span class="number">31</span>]) + <span class="built_in">ord</span>(x[<span class="number">9</span>])) - <span class="number">48</span>)</span><br><span class="line">x[<span class="number">14</span>] = <span class="built_in">chr</span>((<span class="built_in">ord</span>(x[<span class="number">27</span>]) + <span class="built_in">ord</span>(x[<span class="number">28</span>])) - <span class="number">97</span>)</span><br><span class="line">x = x[::-<span class="number">1</span>]</span><br><span class="line">x = <span class="string">&#x27;&#x27;</span>.join(x)</span><br><span class="line"><span class="built_in">print</span>(x)</span><br></pre></td></tr></table></figure>

<h1 id="0x02-Java逆向解密"><a href="#0x02-Java逆向解密" class="headerlink" title="0x02.Java逆向解密"></a>0x02.Java逆向解密</h1><p>代码逻辑很清晰</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> defpackage;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.util.ArrayList;</span><br><span class="line"><span class="keyword">import</span> java.util.Scanner;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* renamed from: Reverse  reason: default package */</span></span><br><span class="line"><span class="keyword">public</span> <span class="class"><span class="keyword">class</span> <span class="title">Reverse</span> </span>&#123;</span><br><span class="line">    <span class="function"><span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title">main</span><span class="params">(String[] args)</span> </span>&#123;</span><br><span class="line">        Scanner s = <span class="keyword">new</span> Scanner(System.in);</span><br><span class="line">        System.out.println(<span class="string">&quot;Please input the flag ：&quot;</span>);</span><br><span class="line">        String str = s.next();</span><br><span class="line">        System.out.println(<span class="string">&quot;Your input is ：&quot;</span>);</span><br><span class="line">        System.out.println(str);</span><br><span class="line">        Encrypt(str.toCharArray());</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title">Encrypt</span><span class="params">(<span class="keyword">char</span>[] arr)</span> </span>&#123;</span><br><span class="line">        <span class="keyword">int</span>[] KEY;</span><br><span class="line">        ArrayList&lt;Integer&gt; Resultlist = <span class="keyword">new</span> ArrayList&lt;&gt;();</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">char</span> c : arr) &#123;</span><br><span class="line">            Resultlist.add(Integer.valueOf((c + <span class="string">&#x27;@&#x27;</span>) ^ <span class="number">32</span>));</span><br><span class="line">        &#125;</span><br><span class="line">        ArrayList&lt;Integer&gt; KEYList = <span class="keyword">new</span> ArrayList&lt;&gt;();</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">int</span> i : <span class="keyword">new</span> <span class="keyword">int</span>[]&#123;<span class="number">180</span>, <span class="number">136</span>, <span class="number">137</span>, <span class="number">147</span>, <span class="number">191</span>, <span class="number">137</span>, <span class="number">147</span>, <span class="number">191</span>, <span class="number">148</span>, <span class="number">136</span>, <span class="number">133</span>, <span class="number">191</span>, <span class="number">134</span>, <span class="number">140</span>, <span class="number">129</span>, <span class="number">135</span>, <span class="number">191</span>, <span class="number">65</span>&#125;) &#123;</span><br><span class="line">            KEYList.add(Integer.valueOf(i));</span><br><span class="line">        &#125;</span><br><span class="line">        System.out.println(<span class="string">&quot;Result:&quot;</span>);</span><br><span class="line">        <span class="keyword">if</span> (Resultlist.equals(KEYList)) &#123;</span><br><span class="line">            System.out.println(<span class="string">&quot;Congratulations！&quot;</span>);</span><br><span class="line">        &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">            System.err.println(<span class="string">&quot;Error！&quot;</span>);</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">flag = [<span class="number">180</span>, <span class="number">136</span>, <span class="number">137</span>, <span class="number">147</span>, <span class="number">191</span>, <span class="number">137</span>, <span class="number">147</span>, <span class="number">191</span>,</span><br><span class="line">        <span class="number">148</span>, <span class="number">136</span>, <span class="number">133</span>, <span class="number">191</span>, <span class="number">134</span>, <span class="number">140</span>, <span class="number">129</span>, <span class="number">135</span>, <span class="number">191</span>, <span class="number">65</span>]</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(flag)):</span><br><span class="line">    flag[i] = <span class="built_in">chr</span>((flag[i] - <span class="built_in">ord</span>(<span class="string">&#x27;@&#x27;</span>)) ^ <span class="number">0x20</span>)</span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span>.join(flag)</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>

<h1 id="0x03-findit"><a href="#0x03-findit" class="headerlink" title="0x03.findit"></a>0x03.findit</h1><p>就是个凯撒</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> com.example.findit;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> android.os.Bundle;</span><br><span class="line"><span class="keyword">import</span> android.support.v7.app.ActionBarActivity;</span><br><span class="line"><span class="keyword">import</span> android.view.MenuItem;</span><br><span class="line"><span class="keyword">import</span> android.view.View;</span><br><span class="line"><span class="keyword">import</span> android.widget.Button;</span><br><span class="line"><span class="keyword">import</span> android.widget.EditText;</span><br><span class="line"><span class="keyword">import</span> android.widget.TextView;</span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="class"><span class="keyword">class</span> <span class="title">MainActivity</span> <span class="keyword">extends</span> <span class="title">ActionBarActivity</span> </span>&#123;</span><br><span class="line">    <span class="comment">/* access modifiers changed from: protected */</span></span><br><span class="line">    <span class="meta">@Override</span> <span class="comment">// android.support.v7.app.ActionBarActivity, android.support.v4.app.FragmentActivity</span></span><br><span class="line">    <span class="function"><span class="keyword">public</span> <span class="keyword">void</span> <span class="title">onCreate</span><span class="params">(Bundle savedInstanceState)</span> </span>&#123;</span><br><span class="line">        <span class="keyword">super</span>.onCreate(savedInstanceState);</span><br><span class="line">        setContentView(R.layout.activity_main);</span><br><span class="line">        <span class="keyword">final</span> EditText edit = (EditText) findViewById(R.id.widget2);</span><br><span class="line">        <span class="keyword">final</span> TextView text = (TextView) findViewById(R.id.widget1);</span><br><span class="line">        <span class="keyword">final</span> <span class="keyword">char</span>[] a = &#123;<span class="string">&#x27;T&#x27;</span>, <span class="string">&#x27;h&#x27;</span>, <span class="string">&#x27;i&#x27;</span>, <span class="string">&#x27;s&#x27;</span>, <span class="string">&#x27;I&#x27;</span>, <span class="string">&#x27;s&#x27;</span>, <span class="string">&#x27;T&#x27;</span>, <span class="string">&#x27;h&#x27;</span>, <span class="string">&#x27;e&#x27;</span>, <span class="string">&#x27;F&#x27;</span>, <span class="string">&#x27;l&#x27;</span>, <span class="string">&#x27;a&#x27;</span>, <span class="string">&#x27;g&#x27;</span>, <span class="string">&#x27;H&#x27;</span>, <span class="string">&#x27;o&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;e&#x27;</span>&#125;;</span><br><span class="line">        <span class="keyword">final</span> <span class="keyword">char</span>[] b = &#123;<span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;v&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;q&#x27;</span>, <span class="string">&#x27;&#123;&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;1&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;5&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;0&#x27;</span>, <span class="string">&#x27;3&#x27;</span>, <span class="string">&#x27;3&#x27;</span>, <span class="string">&#x27;l&#x27;</span>, <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;9&#x27;</span>, <span class="string">&#x27;l&#x27;</span>, <span class="string">&#x27;n&#x27;</span>, <span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;9&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;n&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;8&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;5&#x27;</span>, <span class="string">&#x27;&#125;&#x27;</span>&#125;;</span><br><span class="line">        ((Button) findViewById(R.id.widget3)).setOnClickListener(<span class="keyword">new</span> View.OnClickListener() &#123;</span><br><span class="line">            <span class="comment">/* class com.example.findit.MainActivity.AnonymousClass1 */</span></span><br><span class="line"></span><br><span class="line">            <span class="function"><span class="keyword">public</span> <span class="keyword">void</span> <span class="title">onClick</span><span class="params">(View v)</span> </span>&#123;</span><br><span class="line">                <span class="keyword">char</span>[] x = <span class="keyword">new</span> <span class="keyword">char</span>[<span class="number">17</span>];</span><br><span class="line">                <span class="keyword">char</span>[] y = <span class="keyword">new</span> <span class="keyword">char</span>[<span class="number">38</span>];</span><br><span class="line">                <span class="keyword">for</span> (<span class="keyword">int</span> i = <span class="number">0</span>; i &lt; <span class="number">17</span>; i++) &#123;</span><br><span class="line">                    <span class="keyword">if</span> ((a[i] &lt; <span class="string">&#x27;I&#x27;</span> &amp;&amp; a[i] &gt;= <span class="string">&#x27;A&#x27;</span>) || (a[i] &lt; <span class="string">&#x27;i&#x27;</span> &amp;&amp; a[i] &gt;= <span class="string">&#x27;a&#x27;</span>)) &#123;</span><br><span class="line">                        x[i] = (<span class="keyword">char</span>) (a[i] + <span class="number">18</span>);</span><br><span class="line">                    &#125; <span class="keyword">else</span> <span class="keyword">if</span> ((a[i] &lt; <span class="string">&#x27;A&#x27;</span> || a[i] &gt; <span class="string">&#x27;Z&#x27;</span>) &amp;&amp; (a[i] &lt; <span class="string">&#x27;a&#x27;</span> || a[i] &gt; <span class="string">&#x27;z&#x27;</span>)) &#123;</span><br><span class="line">                        x[i] = a[i];</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        x[i] = (<span class="keyword">char</span>) (a[i] - <span class="string">&#x27;\b&#x27;</span>);</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="keyword">if</span> (String.valueOf(x).equals(edit.getText().toString())) &#123;</span><br><span class="line">                    <span class="keyword">for</span> (<span class="keyword">int</span> i2 = <span class="number">0</span>; i2 &lt; <span class="number">38</span>; i2++) &#123;</span><br><span class="line">                        <span class="keyword">if</span> ((b[i2] &lt; <span class="string">&#x27;A&#x27;</span> || b[i2] &gt; <span class="string">&#x27;Z&#x27;</span>) &amp;&amp; (b[i2] &lt; <span class="string">&#x27;a&#x27;</span> || b[i2] &gt; <span class="string">&#x27;z&#x27;</span>)) &#123;</span><br><span class="line">                            y[i2] = b[i2];</span><br><span class="line">                        &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                            y[i2] = (<span class="keyword">char</span>) (b[i2] + <span class="number">16</span>);</span><br><span class="line">                            <span class="keyword">if</span> ((y[i2] &gt; <span class="string">&#x27;Z&#x27;</span> &amp;&amp; y[i2] &lt; <span class="string">&#x27;a&#x27;</span>) || y[i2] &gt;= <span class="string">&#x27;z&#x27;</span>) &#123;</span><br><span class="line">                                y[i2] = (<span class="keyword">char</span>) (y[i2] - <span class="number">26</span>);</span><br><span class="line">                            &#125;</span><br><span class="line">                        &#125;</span><br><span class="line">                    &#125;</span><br><span class="line">                    text.setText(String.valueOf(y));</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;</span><br><span class="line">                text.setText(<span class="string">&quot;答案错了肿么办。。。不给你又不好意思。。。哎呀好纠结啊~~~&quot;</span>);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">public</span> <span class="keyword">boolean</span> <span class="title">onOptionsItemSelected</span><span class="params">(MenuItem item)</span> </span>&#123;</span><br><span class="line">        <span class="keyword">if</span> (item.getItemId() == R.id.action_settings) &#123;</span><br><span class="line">            <span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> <span class="keyword">super</span>.onOptionsItemSelected(item);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">a = [<span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;v&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;q&#x27;</span>, <span class="string">&#x27;&#123;&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;1&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;5&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;6&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;0&#x27;</span>, <span class="string">&#x27;3&#x27;</span>, <span class="string">&#x27;3&#x27;</span>, <span class="string">&#x27;l&#x27;</span>,</span><br><span class="line">     <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;4&#x27;</span>, <span class="string">&#x27;9&#x27;</span>, <span class="string">&#x27;l&#x27;</span>, <span class="string">&#x27;n&#x27;</span>, <span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;p&#x27;</span>, <span class="string">&#x27;9&#x27;</span>, <span class="string">&#x27;m&#x27;</span>, <span class="string">&#x27;n&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;2&#x27;</span>, <span class="string">&#x27;8&#x27;</span>, <span class="string">&#x27;k&#x27;</span>, <span class="string">&#x27;7&#x27;</span>, <span class="string">&#x27;5&#x27;</span>, <span class="string">&#x27;&#125;&#x27;</span>]</span><br><span class="line">mod = <span class="string">&#x27;abcdefghijklmnopqrstuvwxyz&#x27;</span></span><br><span class="line">aa = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>, <span class="number">27</span>):</span><br><span class="line">    <span class="keyword">for</span> s <span class="keyword">in</span> a:</span><br><span class="line">        <span class="keyword">if</span> s.isalpha():</span><br><span class="line">            n = mod.find(s)</span><br><span class="line">            s = mod[n-i]</span><br><span class="line">        <span class="built_in">print</span>(s, end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    <span class="built_in">print</span>()</span><br></pre></td></tr></table></figure>



<h1 id="0x04-GWCTF-2019-pyre"><a href="#0x04-GWCTF-2019-pyre" class="headerlink" title="0x04.[GWCTF 2019]pyre"></a>0x04.[GWCTF 2019]pyre</h1><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#!/usr/bin/env python</span></span><br><span class="line"><span class="comment"># visit https://tool.lu/pyc/ for more information</span></span><br><span class="line"><span class="built_in">print</span> <span class="string">&#x27;Welcome to Re World!&#x27;</span></span><br><span class="line"><span class="built_in">print</span> <span class="string">&#x27;Your input1 is your flag~&#x27;</span></span><br><span class="line">l = <span class="built_in">len</span>(input1)</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(l):</span><br><span class="line">    num = ((input1[i] + i) % <span class="number">128</span> + <span class="number">128</span>) % <span class="number">128</span></span><br><span class="line">    code += num</span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(l - <span class="number">1</span>):</span><br><span class="line">    code[i] = code[i] ^ code[i + <span class="number">1</span>]</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span> code</span><br><span class="line">code = [</span><br><span class="line">    <span class="string">&#x27;\x1f&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x12&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x1d&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;(&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;0&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;4&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x01&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x06&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x14&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;4&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;,&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x1b&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;U&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;?&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;o&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;6&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;*&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;:&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x01&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;D&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;;&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;%&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x13&#x27;</span>]</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line">code = [</span><br><span class="line">    <span class="string">&#x27;\x1f&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x12&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x1d&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;(&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;0&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;4&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x01&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x06&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x14&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;4&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;,&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x1b&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;U&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;?&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;o&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;6&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;*&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;:&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x01&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;D&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;;&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;%&#x27;</span>,</span><br><span class="line">    <span class="string">&#x27;\x13&#x27;</span>]</span><br><span class="line"></span><br><span class="line">n = <span class="built_in">len</span>(code)</span><br><span class="line"><span class="built_in">print</span>(n)</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(n-<span class="number">2</span>, -<span class="number">1</span>, -<span class="number">1</span>):</span><br><span class="line">    code[i] = <span class="built_in">chr</span>(<span class="built_in">ord</span>(code[i]) ^ <span class="built_in">ord</span>(code[i+<span class="number">1</span>])</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(n):</span><br><span class="line">    <span class="built_in">print</span>(<span class="built_in">chr</span>((<span class="built_in">ord</span>(code[i])-i) % <span class="number">128</span>), end=<span class="string">&quot;&quot;</span>)</span><br></pre></td></tr></table></figure>

<p>代码功底还是太烂了。</p>
<h1 id="0x05-ACTF新生赛2020-easyre"><a href="#0x05-ACTF新生赛2020-easyre" class="headerlink" title="0x05.[ACTF新生赛2020]easyre"></a>0x05.[ACTF新生赛2020]easyre</h1><p>peid查完是upx壳，脱壳：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211024154813690.png" alt="image-20211024154813690"></p>
<p>清晰了很多：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211024162234474.png" alt="image-20211024162234474"></p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211024155033211.png" alt="image-20211024155033211"></p>
<p>就是</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># !\&quot;&#x27;</span></span><br><span class="line"><span class="built_in">str</span> = <span class="string">&#x27;&#x27;&#x27;~&#125;|&#123;zyxwvutsrqponmlkjihgfedcba`_^]\\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?&gt;=&lt;;:9876543210/.-,+*)(&#x27;&amp;%$# !\&quot;&#x27;&#x27;&#x27;</span></span><br><span class="line">v4 = <span class="string">&#x27;&#x27;&#x27;*F&#x27;\&quot;N,\&quot;(I?+@&#x27;&#x27;&#x27;</span></span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="comment"># v4 = list(v4)</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> v4:</span><br><span class="line">    flag += <span class="built_in">chr</span>(<span class="built_in">str</span>.find(i)+<span class="number">1</span>)</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>

<h1 id="0x06-rsa"><a href="#0x06-rsa" class="headerlink" title="0x06.rsa"></a>0x06.rsa</h1><p>第一次做RSA的题，就先看了一遍RSA的流程。</p>
<p>这个题给了两个文件：flag.enc，pub.key</p>
<blockquote>
<p>  公钥N &#x3D; p*q,(为pub.key),e</p>
<p>  e是随机选择的数，d是e关于phi(N)的模反元素：ed≡1(mod phi(N))</p>
<p>  私钥：N,d</p>
</blockquote>
<p>copy到公钥解析的网站进行解析：<a target="_blank" rel="noopener" href="http://tool.chacuo.net//cryptrsakeyparse">http://tool.chacuo.net//cryptrsakeyparse</a></p>
<table>
<thead>
<tr>
<th>key长度：</th>
<th>256</th>
</tr>
</thead>
<tbody><tr>
<td>模数(N)：</td>
<td>C0332C5C64AE47182F6C1C876D42336910545A58F7EEFEFC0BCAAF5AF341CCDD</td>
</tr>
<tr>
<td>指数(e)：</td>
<td>65537 (0x10001)</td>
</tr>
</tbody></table>
<p>所以：e &#x3D;  65537</p>
<p>N &#x3D; C0332C5C64AE47182F6C1C876D42336910545A58F7EEFEFC0BCAAF5AF341CCDD(要转成10进制)</p>
<p>再通过网站分解N得到pq：<a target="_blank" rel="noopener" href="http://www.factordb.com/index.php?query=">http://www.factordb.com/index.php?query=</a></p>
<p>得到：</p>
<p>p &#x3D; 285960468890451637935629440372639283459<br>q &#x3D; 304008741604601924494328155975272418463</p>
<p>再接下来就是写exp了：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> rsa</span><br><span class="line"><span class="keyword">import</span> gmpy2</span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">n = <span class="number">86934482296048119190666062003494800588905656017203025617216654058378322103517</span></span><br><span class="line">p = <span class="number">285960468890451637935629440372639283459</span></span><br><span class="line">q = <span class="number">304008741604601924494328155975272418463</span></span><br><span class="line"></span><br><span class="line">phin = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = gmpy2.invert(e, phin)</span><br><span class="line">key = rsa.PrivateKey(n, e, <span class="built_in">int</span>(d), p, q)</span><br><span class="line"></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;D:\\Desktop\\output\\flag.enc&quot;</span>, <span class="string">&quot;rb+&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">    f = f.read()</span><br><span class="line">    <span class="built_in">print</span>(rsa.decrypt(f, key))</span><br><span class="line"></span><br></pre></td></tr></table></figure>





<h1 id="0x07-ACTF新生赛2020-rome"><a href="#0x07-ACTF新生赛2020-rome" class="headerlink" title="0x07.[ACTF新生赛2020]rome"></a>0x07.[ACTF新生赛2020]rome</h1><p>简化了下代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">func</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> v1[<span class="number">16</span>]; <span class="comment">// [esp+14h] [ebp-44h]</span></span><br><span class="line">  <span class="keyword">char</span> input_str[<span class="number">22</span>]; <span class="comment">// [esp+24h] [ebp-34h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> local_str[<span class="number">29</span>]; <span class="comment">// [esp+3Bh] [ebp-1Dh] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">strcpy</span>(local_str, <span class="string">&quot;Qsw3sj_lz4_Ujw@l&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Please input:&quot;</span>);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, input_str);</span><br><span class="line">  result = input_str[<span class="number">0</span>];</span><br><span class="line">  <span class="keyword">if</span> ( input_str[<span class="number">0</span>] == <span class="string">&#x27;A&#x27;</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    result = input_str[<span class="number">1</span>];</span><br><span class="line">    <span class="keyword">if</span> ( input_str[<span class="number">1</span>] == <span class="string">&#x27;C&#x27;</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      result = input_str[<span class="number">2</span>];</span><br><span class="line">      <span class="keyword">if</span> ( input_str[<span class="number">2</span>] == <span class="string">&#x27;T&#x27;</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        result = input_str[<span class="number">3</span>];</span><br><span class="line">        <span class="keyword">if</span> ( input_str[<span class="number">3</span>] == <span class="string">&#x27;F&#x27;</span> )</span><br><span class="line">        &#123;</span><br><span class="line">          result = input_str[<span class="number">4</span>];</span><br><span class="line">          <span class="keyword">if</span> ( input_str[<span class="number">4</span>] == <span class="string">&#x27;&#123;&#x27;</span> )</span><br><span class="line">          &#123;</span><br><span class="line">            result = input_str[<span class="number">21</span>];</span><br><span class="line">            <span class="keyword">if</span> ( input_str[<span class="number">21</span>] == <span class="string">&#x27;&#125;&#x27;</span> )</span><br><span class="line">            &#123;</span><br><span class="line">              *v1 = *&amp;input_str[<span class="number">5</span>];</span><br><span class="line">              *&amp;v1[<span class="number">4</span>] = *&amp;input_str[<span class="number">9</span>];</span><br><span class="line">              *&amp;v1[<span class="number">8</span>] = *&amp;input_str[<span class="number">13</span>];</span><br><span class="line">              *&amp;v1[<span class="number">12</span>] = *&amp;input_str[<span class="number">17</span>];</span><br><span class="line">              *&amp;local_str[<span class="number">17</span>] = <span class="number">0</span>;</span><br><span class="line">              <span class="keyword">while</span> ( *&amp;local_str[<span class="number">17</span>] &lt;= <span class="number">15</span> )</span><br><span class="line">              &#123;</span><br><span class="line">                <span class="keyword">if</span> ( v1[*&amp;local_str[<span class="number">17</span>]] &gt; <span class="number">64</span> &amp;&amp; v1[*&amp;local_str[<span class="number">17</span>]] &lt;= <span class="number">90</span> )<span class="comment">// 大写</span></span><br><span class="line">                  v1[*&amp;local_str[<span class="number">17</span>]] = (v1[*&amp;local_str[<span class="number">17</span>]] - <span class="number">51</span>) % <span class="number">26</span> + <span class="number">65</span>;</span><br><span class="line">                <span class="keyword">if</span> ( v1[*&amp;local_str[<span class="number">17</span>]] &gt; <span class="number">96</span> &amp;&amp; v1[*&amp;local_str[<span class="number">17</span>]] &lt;= <span class="number">122</span> )<span class="comment">// 小写</span></span><br><span class="line">                  v1[*&amp;local_str[<span class="number">17</span>]] = (v1[*&amp;local_str[<span class="number">17</span>]] - <span class="number">79</span>) % <span class="number">26</span> + <span class="number">97</span>;</span><br><span class="line">                ++*&amp;local_str[<span class="number">17</span>];</span><br><span class="line">              &#125;</span><br><span class="line">              *&amp;local_str[<span class="number">17</span>] = <span class="number">0</span>;</span><br><span class="line">              <span class="keyword">while</span> ( *&amp;local_str[<span class="number">17</span>] &lt;= <span class="number">15</span> )</span><br><span class="line">              &#123;</span><br><span class="line">                result = local_str[*&amp;local_str[<span class="number">17</span>]];</span><br><span class="line">                <span class="keyword">if</span> ( v1[*&amp;local_str[<span class="number">17</span>]] != result )</span><br><span class="line">                  <span class="keyword">return</span> result;</span><br><span class="line">                ++*&amp;local_str[<span class="number">17</span>];</span><br><span class="line">              &#125;</span><br><span class="line">              result = <span class="built_in">printf</span>(<span class="string">&quot;You are correct!&quot;</span>);</span><br><span class="line">            &#125;</span><br><span class="line">          &#125;</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">local = <span class="string">&quot;Qsw3sj_lz4_Ujw@l&quot;</span></span><br><span class="line">a = <span class="number">0</span></span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> k <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">16</span>):</span><br><span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">33</span>, <span class="number">128</span>):</span><br><span class="line">        a = i</span><br><span class="line">        <span class="keyword">if</span> i &gt; <span class="number">64</span>:</span><br><span class="line">            <span class="keyword">if</span> i &lt;= <span class="number">90</span>:</span><br><span class="line">                a = (i-<span class="number">51</span>) % <span class="number">26</span> + <span class="number">65</span></span><br><span class="line">        <span class="keyword">if</span> i &gt; <span class="number">96</span>:</span><br><span class="line">            <span class="keyword">if</span> i &lt;= <span class="number">122</span>:</span><br><span class="line">                a = (i-<span class="number">0x4f</span>) % <span class="number">26</span> + <span class="number">97</span></span><br><span class="line">        <span class="keyword">if</span> <span class="built_in">chr</span>(a) == local[k]:</span><br><span class="line">            flag += <span class="built_in">chr</span>(i)</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>

<h1 id="0x08-2019红帽杯-easyRE"><a href="#0x08-2019红帽杯-easyRE" class="headerlink" title="0x08.[2019红帽杯]easyRE"></a>0x08.[2019红帽杯]easyRE</h1><p>讲真我还是太拉了，这题把wp看了半天，代码也看了半天。。。先看题吧：</p>
<p>刚进去代码完全看不懂，然后应该是要输入些什么东西，</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211025193922062.png" alt="image-20211025193922062"></p>
<p>这里是将输入的东西异或后与本地的字符串比较，解一下：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">local_str = [<span class="number">73</span>, <span class="number">111</span>, <span class="number">100</span>, <span class="number">108</span>, <span class="number">62</span>, <span class="number">81</span>, <span class="number">110</span>, <span class="number">98</span>, <span class="number">40</span>, <span class="number">111</span>, <span class="number">99</span>, <span class="number">121</span>, <span class="number">127</span>, <span class="number">121</span>, <span class="number">46</span>, <span class="number">105</span>, <span class="number">127</span>, <span class="number">100</span>, <span class="number">96</span>, <span class="number">51</span>, <span class="number">119</span>, <span class="number">125</span>,</span><br><span class="line">             <span class="number">119</span>, <span class="number">101</span>, <span class="number">107</span>, <span class="number">57</span>, <span class="number">123</span>, <span class="number">105</span>, <span class="number">121</span>, <span class="number">61</span>, <span class="number">126</span>, <span class="number">121</span>, <span class="number">76</span>, <span class="number">64</span>, <span class="number">69</span>, <span class="number">67</span>]</span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(local_str)):</span><br><span class="line">    <span class="keyword">for</span> j <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">128</span>):</span><br><span class="line">        <span class="keyword">if</span> j ^ i == local_str[i]:</span><br><span class="line">            <span class="built_in">print</span>(<span class="built_in">chr</span>(j), end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line"><span class="comment">#output: Info:The first four chars are `flag`</span></span><br></pre></td></tr></table></figure>

<p>之后是又一次的输入：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211025195507127.png" alt="image-20211025195507127"></p>
<p>会base64进行10次后和本地的另一个字符串比较，解密10次后发现这是个假的hint……..</p>
<p>接下来的一点是我怎么都没想到的，，在字符串的下面有个常量，在另一个函数有调用：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211025200621618.png" alt="image-20211025200621618"></p>
<p>x查看交叉引用，关键代码：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211026141034428.png" alt="image-20211026141034428"></p>
<p>输入的第一位和第四位和本地的字符串异或之后要分别为f和g，猜测前4位为flag，后面的是循环异或</p>
<p>shift+e提取数据，exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">str</span> = [</span><br><span class="line">    <span class="number">0x40</span>, <span class="number">0x35</span>, <span class="number">0x20</span>, <span class="number">0x56</span>, <span class="number">0x5D</span>, <span class="number">0x18</span>, <span class="number">0x22</span>, <span class="number">0x45</span>, <span class="number">0x17</span>, <span class="number">0x2F</span>,</span><br><span class="line">    <span class="number">0x24</span>, <span class="number">0x6E</span>, <span class="number">0x62</span>, <span class="number">0x3C</span>, <span class="number">0x27</span>, <span class="number">0x54</span>, <span class="number">0x48</span>, <span class="number">0x6C</span>, <span class="number">0x24</span>, <span class="number">0x6E</span>,</span><br><span class="line">    <span class="number">0x72</span>, <span class="number">0x3C</span>, <span class="number">0x32</span>, <span class="number">0x45</span>, <span class="number">0x5B</span></span><br><span class="line">]</span><br><span class="line">flag = <span class="string">&#x27;flag&#x27;</span></span><br><span class="line">qq = []</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(flag)):</span><br><span class="line">    qq.append(<span class="built_in">chr</span>(<span class="built_in">ord</span>(flag[i]) ^ <span class="built_in">str</span>[i]))</span><br><span class="line"><span class="built_in">print</span>(qq)</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(<span class="built_in">str</span>)):</span><br><span class="line">    a = <span class="built_in">chr</span>(<span class="built_in">str</span>[i] ^ <span class="built_in">ord</span>(qq[i % <span class="number">4</span>]))</span><br><span class="line">    <span class="built_in">print</span>(a, end=<span class="string">&#x27;&#x27;</span>)</span><br></pre></td></tr></table></figure>

<h1 id="0x09-FlareOn4-login"><a href="#0x09-FlareOn4-login" class="headerlink" title="0x09.[FlareOn4]login"></a>0x09.[FlareOn4]login</h1><p>关键的部分就只有12行的那部分：</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!DOCTYPE <span class="meta-keyword">Html</span> /&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">html</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;<span class="name">head</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">title</span>&gt;</span>FLARE On 2017<span class="tag">&lt;/<span class="name">title</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;/<span class="name">head</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;<span class="name">body</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">&quot;text&quot;</span> <span class="attr">name</span>=<span class="string">&quot;flag&quot;</span> <span class="attr">id</span>=<span class="string">&quot;flag&quot;</span> <span class="attr">value</span>=<span class="string">&quot;Enter the flag&quot;</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">&quot;button&quot;</span> <span class="attr">id</span>=<span class="string">&quot;prompt&quot;</span> <span class="attr">value</span>=<span class="string">&quot;Click to check the flag&quot;</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">script</span> <span class="attr">type</span>=<span class="string">&quot;text/javascript&quot;</span>&gt;</span><span class="javascript"></span></span><br><span class="line"><span class="javascript">            <span class="built_in">document</span>.getElementById(<span class="string">&quot;prompt&quot;</span>).onclick = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span></span><br><span class="line"><span class="javascript">                <span class="keyword">var</span> flag = <span class="built_in">document</span>.getElementById(<span class="string">&quot;flag&quot;</span>).value;</span></span><br><span class="line"><span class="javascript">                <span class="keyword">var</span> rotFlag = flag.replace(<span class="regexp">/[a-zA-Z]/g</span>, <span class="function"><span class="keyword">function</span>(<span class="params">c</span>)</span>&#123;<span class="keyword">return</span> <span class="built_in">String</span>.fromCharCode((c &lt;= <span class="string">&quot;Z&quot;</span> ? <span class="number">90</span> : <span class="number">122</span>) &gt;= (c = c.charCodeAt(<span class="number">0</span>) + <span class="number">13</span>) ? c : c - <span class="number">26</span>);&#125;);</span></span><br><span class="line"><span class="javascript">                <span class="keyword">if</span> (<span class="string">&quot;PyvragFvqrYbtvafNerRnfl@syner-ba.pbz&quot;</span> == rotFlag) &#123;</span></span><br><span class="line"><span class="javascript">                    alert(<span class="string">&quot;Correct flag!&quot;</span>);</span></span><br><span class="line"><span class="javascript">                &#125; <span class="keyword">else</span> &#123;</span></span><br><span class="line"><span class="javascript">                    alert(<span class="string">&quot;Incorrect flag, rot again&quot;</span>);</span></span><br><span class="line"><span class="javascript">                &#125;</span></span><br><span class="line"><span class="javascript">            &#125;</span></span><br><span class="line"><span class="javascript">        </span><span class="tag">&lt;/<span class="name">script</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;/<span class="name">body</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">html</span>&gt;</span></span><br></pre></td></tr></table></figure>

<p>其实就是rot13，在if前面把rotflag给输出一下就OK。</p>
<h1 id="0x0A-GUET-CTF2019-re"><a href="#0x0A-GUET-CTF2019-re" class="headerlink" title="0x0A.[GUET-CTF2019]re"></a>0x0A.[GUET-CTF2019]re</h1><blockquote>
<p>  考点是z3约束器相关：</p>
<p>  <a target="_blank" rel="noopener" href="https://arabelatso.github.io/2018/06/14/Z3%20API%20in%20Python/">https://arabelatso.github.io/2018/06/14/Z3%20API%20in%20Python/</a></p>
</blockquote>
<p>exeinfope查壳之后发现是upx壳，脱掉之后：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">mian</span><span class="params">(__int64 a1, <span class="keyword">int</span> a2, <span class="keyword">int</span> a3, <span class="keyword">int</span> a4, <span class="keyword">int</span> a5, <span class="keyword">int</span> a6)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v6; <span class="comment">// edx</span></span><br><span class="line">  <span class="keyword">int</span> v7; <span class="comment">// ecx</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// er8</span></span><br><span class="line">  <span class="keyword">int</span> v9; <span class="comment">// er9</span></span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line">  <span class="keyword">char</span> v11[<span class="number">32</span>]; <span class="comment">// [rsp+0h] [rbp-30h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v12; <span class="comment">// [rsp+28h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v12 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  *&amp;v11[<span class="number">8</span>] = <span class="number">0LL</span>;</span><br><span class="line">  *&amp;v11[<span class="number">16</span>] = <span class="number">0LL</span>;</span><br><span class="line">  *&amp;v11[<span class="number">24</span>] = <span class="number">0LL</span>;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;input your flag:&quot;</span>, a2, a3, a4, a5, a6);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, v11, v6, v7, v8, v9, <span class="number">0</span>);</span><br><span class="line">  <span class="keyword">if</span> ( check(v11) )</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Correct!&quot;</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Wrong!&quot;</span>);</span><br><span class="line">  result = <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( __readfsqword(<span class="number">0x28</span>u) != v12 )</span><br><span class="line">    sub_443550();</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>最关键的就是check那个了：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">_BOOL8 __fastcall <span class="title">check</span><span class="params">(<span class="keyword">char</span> *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">1629056</span> * *a1 != <span class="number">166163712</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">6771600</span> * a1[<span class="number">1</span>] != <span class="number">731332800</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">3682944</span> * a1[<span class="number">2</span>] != <span class="number">357245568</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">10431000</span> * a1[<span class="number">3</span>] != <span class="number">1074393000</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">3977328</span> * a1[<span class="number">4</span>] != <span class="number">489211344</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">5138336</span> * a1[<span class="number">5</span>] != <span class="number">518971936</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">7532250</span> * a1[<span class="number">7</span>] != <span class="number">406741500</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">5551632</span> * a1[<span class="number">8</span>] != <span class="number">294236496</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">3409728</span> * a1[<span class="number">9</span>] != <span class="number">177305856</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">13013670</span> * a1[<span class="number">10</span>] != <span class="number">650683500</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">6088797</span> * a1[<span class="number">11</span>] != <span class="number">298351053</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">7884663</span> * a1[<span class="number">12</span>] != <span class="number">386348487</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">8944053</span> * a1[<span class="number">13</span>] != <span class="number">438258597</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">5198490</span> * a1[<span class="number">14</span>] != <span class="number">249527520</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">4544518</span> * a1[<span class="number">15</span>] != <span class="number">445362764</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">3645600</span> * a1[<span class="number">17</span>] != <span class="number">174988800</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">10115280</span> * a1[<span class="number">16</span>] != <span class="number">981182160</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">9667504</span> * a1[<span class="number">18</span>] != <span class="number">493042704</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">5364450</span> * a1[<span class="number">19</span>] != <span class="number">257493600</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">13464540</span> * a1[<span class="number">20</span>] != <span class="number">767478780</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">5488432</span> * a1[<span class="number">21</span>] != <span class="number">312840624</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">14479500</span> * a1[<span class="number">22</span>] != <span class="number">1404511500</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">6451830</span> * a1[<span class="number">23</span>] != <span class="number">316139670</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">6252576</span> * a1[<span class="number">24</span>] != <span class="number">619005024</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">7763364</span> * a1[<span class="number">25</span>] != <span class="number">372641472</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">7327320</span> * a1[<span class="number">26</span>] != <span class="number">373693320</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">8741520</span> * a1[<span class="number">27</span>] != <span class="number">498266640</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">8871876</span> * a1[<span class="number">28</span>] != <span class="number">452465676</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">4086720</span> * a1[<span class="number">29</span>] != <span class="number">208422720</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">9374400</span> * a1[<span class="number">30</span>] == <span class="number">515592000</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">5759124</span> * a1[<span class="number">31</span>] == <span class="number">719890500</span>;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>可以手动一个一个解，也可z3：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> z3 <span class="keyword">import</span> *</span><br><span class="line">s = Solver()</span><br><span class="line">a1 = [<span class="number">0</span>]*<span class="number">32</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">32</span>):</span><br><span class="line">    a1[i] = Int(<span class="string">&#x27;a1[&#x27;</span>+<span class="built_in">str</span>(i)+<span class="string">&#x27;]&#x27;</span>)</span><br><span class="line"></span><br><span class="line">s.add(<span class="number">1629056</span> * a1[<span class="number">0</span>] == <span class="number">166163712</span>)</span><br><span class="line">s.add(<span class="number">6771600</span> * a1[<span class="number">1</span>] == <span class="number">731332800</span>)</span><br><span class="line">s.add(<span class="number">3682944</span> * a1[<span class="number">2</span>] == <span class="number">357245568</span>)</span><br><span class="line">s.add(<span class="number">10431000</span> * a1[<span class="number">3</span>] == <span class="number">1074393000</span>)</span><br><span class="line">s.add(<span class="number">3977328</span> * a1[<span class="number">4</span>] == <span class="number">489211344</span>)</span><br><span class="line">s.add(<span class="number">5138336</span> * a1[<span class="number">5</span>] == <span class="number">518971936</span>)</span><br><span class="line">s.add(<span class="number">7532250</span> * a1[<span class="number">7</span>] == <span class="number">406741500</span>)</span><br><span class="line">s.add(<span class="number">5551632</span> * a1[<span class="number">8</span>] == <span class="number">294236496</span>)</span><br><span class="line">s.add(<span class="number">3409728</span> * a1[<span class="number">9</span>] == <span class="number">177305856</span>)</span><br><span class="line">s.add(<span class="number">13013670</span> * a1[<span class="number">10</span>] == <span class="number">650683500</span>)</span><br><span class="line">s.add(<span class="number">6088797</span> * a1[<span class="number">11</span>] == <span class="number">298351053</span>)</span><br><span class="line">s.add(<span class="number">7884663</span> * a1[<span class="number">12</span>] == <span class="number">386348487</span>)</span><br><span class="line">s.add(<span class="number">8944053</span> * a1[<span class="number">13</span>] == <span class="number">438258597</span>)</span><br><span class="line">s.add(<span class="number">5198490</span> * a1[<span class="number">14</span>] == <span class="number">249527520</span>)</span><br><span class="line">s.add(<span class="number">4544518</span> * a1[<span class="number">15</span>] == <span class="number">445362764</span>)</span><br><span class="line">s.add(<span class="number">3645600</span> * a1[<span class="number">17</span>] == <span class="number">174988800</span>)</span><br><span class="line">s.add(<span class="number">10115280</span> * a1[<span class="number">16</span>] == <span class="number">981182160</span>)</span><br><span class="line">s.add(<span class="number">9667504</span> * a1[<span class="number">18</span>] == <span class="number">493042704</span>)</span><br><span class="line">s.add(<span class="number">5364450</span> * a1[<span class="number">19</span>] == <span class="number">257493600</span>)</span><br><span class="line">s.add(<span class="number">13464540</span> * a1[<span class="number">20</span>] == <span class="number">767478780</span>)</span><br><span class="line">s.add(<span class="number">5488432</span> * a1[<span class="number">21</span>] == <span class="number">312840624</span>)</span><br><span class="line">s.add(<span class="number">14479500</span> * a1[<span class="number">22</span>] == <span class="number">1404511500</span>)</span><br><span class="line">s.add(<span class="number">6451830</span> * a1[<span class="number">23</span>] == <span class="number">316139670</span>)</span><br><span class="line">s.add(<span class="number">6252576</span> * a1[<span class="number">24</span>] == <span class="number">619005024</span>)</span><br><span class="line">s.add(<span class="number">7763364</span> * a1[<span class="number">25</span>] == <span class="number">372641472</span>)</span><br><span class="line">s.add(<span class="number">7327320</span> * a1[<span class="number">26</span>] == <span class="number">373693320</span>)</span><br><span class="line">s.add(<span class="number">8741520</span> * a1[<span class="number">27</span>] == <span class="number">498266640</span>)</span><br><span class="line">s.add(<span class="number">8871876</span> * a1[<span class="number">28</span>] == <span class="number">452465676</span>)</span><br><span class="line">s.add(<span class="number">4086720</span> * a1[<span class="number">29</span>] == <span class="number">208422720</span>)</span><br><span class="line">s.add(<span class="number">9374400</span> * a1[<span class="number">30</span>] == <span class="number">515592000</span>)</span><br><span class="line">s.add(<span class="number">5759124</span> * a1[<span class="number">31</span>] == <span class="number">719890500</span>)</span><br><span class="line">s.check()</span><br><span class="line"><span class="built_in">print</span>(s.model())</span><br></pre></td></tr></table></figure>

<p>输出：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line">[a1[31] = 125,</span><br><span class="line"> a1[30] = 55,</span><br><span class="line"> a1[29] = 51,</span><br><span class="line"> a1[28] = 51,</span><br><span class="line"> a1[27] = 57,</span><br><span class="line"> a1[26] = 51,</span><br><span class="line"> a1[25] = 48,</span><br><span class="line"> a1[24] = 99,</span><br><span class="line"> a1[23] = 49,</span><br><span class="line"> a1[22] = 97,</span><br><span class="line"> a1[21] = 57,</span><br><span class="line"> a1[20] = 57,</span><br><span class="line"> a1[19] = 48,</span><br><span class="line"> a1[18] = 51,</span><br><span class="line"> a1[16] = 97,</span><br><span class="line"> a1[17] = 48,</span><br><span class="line"> a1[15] = 98,</span><br><span class="line"> a1[14] = 48,</span><br><span class="line"> a1[13] = 49,</span><br><span class="line"> a1[12] = 49,</span><br><span class="line"> a1[11] = 49,</span><br><span class="line"> a1[10] = 50,</span><br><span class="line"> a1[9] = 52,</span><br><span class="line"> a1[8] = 53,</span><br><span class="line"> a1[7] = 54,</span><br><span class="line"> a1[5] = 101,</span><br><span class="line"> a1[4] = 123,</span><br><span class="line"> a1[3] = 103,</span><br><span class="line"> a1[2] = 97,</span><br><span class="line"> a1[1] = 108,</span><br><span class="line"> a1[0] = 102]</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line">a1 = [<span class="number">0</span>]*<span class="number">32</span></span><br><span class="line">a1[<span class="number">31</span>] = <span class="number">125</span></span><br><span class="line">a1[<span class="number">30</span>] = <span class="number">55</span></span><br><span class="line">a1[<span class="number">29</span>] = <span class="number">51</span></span><br><span class="line">a1[<span class="number">28</span>] = <span class="number">51</span></span><br><span class="line">a1[<span class="number">27</span>] = <span class="number">57</span></span><br><span class="line">a1[<span class="number">26</span>] = <span class="number">51</span></span><br><span class="line">a1[<span class="number">25</span>] = <span class="number">48</span></span><br><span class="line">a1[<span class="number">24</span>] = <span class="number">99</span></span><br><span class="line">a1[<span class="number">23</span>] = <span class="number">49</span></span><br><span class="line">a1[<span class="number">22</span>] = <span class="number">97</span></span><br><span class="line">a1[<span class="number">21</span>] = <span class="number">57</span></span><br><span class="line">a1[<span class="number">20</span>] = <span class="number">57</span></span><br><span class="line">a1[<span class="number">19</span>] = <span class="number">48</span></span><br><span class="line">a1[<span class="number">18</span>] = <span class="number">51</span></span><br><span class="line">a1[<span class="number">16</span>] = <span class="number">97</span></span><br><span class="line">a1[<span class="number">17</span>] = <span class="number">48</span></span><br><span class="line">a1[<span class="number">15</span>] = <span class="number">98</span></span><br><span class="line">a1[<span class="number">14</span>] = <span class="number">48</span></span><br><span class="line">a1[<span class="number">13</span>] = <span class="number">49</span></span><br><span class="line">a1[<span class="number">12</span>] = <span class="number">49</span></span><br><span class="line">a1[<span class="number">11</span>] = <span class="number">49</span></span><br><span class="line">a1[<span class="number">10</span>] = <span class="number">50</span></span><br><span class="line">a1[<span class="number">9</span>] = <span class="number">52</span></span><br><span class="line">a1[<span class="number">8</span>] = <span class="number">53</span></span><br><span class="line">a1[<span class="number">7</span>] = <span class="number">54</span></span><br><span class="line">a1[<span class="number">5</span>] = <span class="number">101</span></span><br><span class="line">a1[<span class="number">4</span>] = <span class="number">123</span></span><br><span class="line">a1[<span class="number">3</span>] = <span class="number">103</span></span><br><span class="line">a1[<span class="number">2</span>] = <span class="number">97</span></span><br><span class="line">a1[<span class="number">1</span>] = <span class="number">108</span></span><br><span class="line">a1[<span class="number">0</span>] = <span class="number">102</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">32</span>):</span><br><span class="line">    <span class="keyword">if</span> i == <span class="number">6</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="string">&#x27;1&#x27;</span>, end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="built_in">chr</span>(a1[i]), end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>这里因为6没有，所以只能一个一个试，恰巧第一个就可。</p>
<h1 id="0x0B-SUCTF2019-SignIn"><a href="#0x0B-SUCTF2019-SignIn" class="headerlink" title="0x0B.[SUCTF2019]SignIn"></a>0x0B.[SUCTF2019]SignIn</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v4[<span class="number">16</span>]; <span class="comment">// [rsp+0h] [rbp-4A0h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v5[<span class="number">16</span>]; <span class="comment">// [rsp+10h] [rbp-490h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v6[<span class="number">16</span>]; <span class="comment">// [rsp+20h] [rbp-480h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v7[<span class="number">16</span>]; <span class="comment">// [rsp+30h] [rbp-470h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">112</span>]; <span class="comment">// [rsp+40h] [rbp-460h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v9[<span class="number">1000</span>]; <span class="comment">// [rsp+B0h] [rbp-3F0h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v10; <span class="comment">// [rsp+498h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v10 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;[sign in]&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;[input your flag]: &quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%99s&quot;</span>, input);</span><br><span class="line">  sub_96A(input, v9);</span><br><span class="line">  __gmpz_init_set_str(v7, <span class="string">&quot;ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35&quot;</span>, <span class="number">16LL</span>);</span><br><span class="line">  __gmpz_init_set_str(v6, v9, <span class="number">16LL</span>);</span><br><span class="line">  __gmpz_init_set_str(v4, <span class="string">&quot;103461035900816914121390101299049044413950405173712170434161686539878160984549&quot;</span>, <span class="number">10LL</span>);</span><br><span class="line">  __gmpz_init_set_str(v5, <span class="string">&quot;65537&quot;</span>, <span class="number">10LL</span>);</span><br><span class="line">  __gmpz_powm(v6, v6, v5, v4);</span><br><span class="line">  <span class="keyword">if</span> ( __gmpz_cmp(v6, v7) )</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;GG!&quot;</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;TTTTTTTTTTql!&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中的<code>sub_96A</code>就是转16进制，然后是<code>__gmpz_init_set_str</code>，这个是 GNU 高精度算法库。贴个官网:<a target="_blank" rel="noopener" href="https://gmplib.org/manual/">https://gmplib.org/manual/</a></p>
<p><code>__gmpz_powm</code>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">mpz_powm</span> <span class="params">(<span class="keyword">mpz_t</span> rop, <span class="keyword">const</span> <span class="keyword">mpz_t</span> base, <span class="keyword">const</span> <span class="keyword">mpz_t</span> <span class="built_in">exp</span>, <span class="keyword">const</span> <span class="keyword">mpz_t</span> mod)</span> [Function]</span></span><br><span class="line"><span class="function">Set rop to base^<span class="built_in">exp</span> mod mod.</span></span><br></pre></td></tr></table></figure>

<p>就是计算base的exp次方，然后对mod取模，存到rop。</p>
<p>这里再看下RSA的加解密情况：</p>
<blockquote>
<p>  c  &#x3D; (m ^ e) mod n</p>
<p>  其中c为密文，m为明文，e为公钥</p>
</blockquote>
<blockquote>
<p>  m &#x3D; (c ^ d) mod n</p>
<p>  d是e关于phi(N)的模反元素</p>
</blockquote>
<p>于是乎：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">C = ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35</span><br><span class="line">m = input</span><br><span class="line">e = 65537</span><br><span class="line">N = 103461035900816914121390101299049044413950405173712170434161686539878160984549</span><br></pre></td></tr></table></figure>

<p>可以通过在线网站分解pq或者使用yafu也可：</p>
<blockquote>
<p>  p &#x3D; 282164587459512124844245113950593348271</p>
<p>  q &#x3D; 366669102002966856876605669837014229419</p>
</blockquote>
<p>再之后就是计算私钥d，根据密文，私钥，N计算明文</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> gmpy2</span><br><span class="line"><span class="keyword">import</span> binascii</span><br><span class="line">C = <span class="number">0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">N = <span class="number">103461035900816914121390101299049044413950405173712170434161686539878160984549</span></span><br><span class="line">p = <span class="number">282164587459512124844245113950593348271</span></span><br><span class="line">q = <span class="number">366669102002966856876605669837014229419</span></span><br><span class="line">d = gmpy2.invert(e, (q-<span class="number">1</span>)*(p-<span class="number">1</span>))</span><br><span class="line">m = gmpy2.powmod(C, d, N)</span><br><span class="line"><span class="comment"># print(m)</span></span><br><span class="line"><span class="built_in">print</span>(binascii.unhexlify(<span class="built_in">hex</span>(m)[<span class="number">2</span>:]).decode(encoding=<span class="string">&#x27;utf-8&#x27;</span>))</span><br></pre></td></tr></table></figure>

<h1 id="0x0C-Youngter-drive"><a href="#0x0C-Youngter-drive" class="headerlink" title="0x0C.Youngter-drive"></a>0x0C.Youngter-drive</h1><p>查壳发现是upx，有一个输入，然后是两个线程</p>
<p>先看下第一个线程：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __stdcall <span class="title">StartAddress_0</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    WaitForSingleObject(hObject, <span class="number">0xFFFFFFFF</span>);</span><br><span class="line">    <span class="keyword">if</span> ( dword_418008 &gt; <span class="number">-1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      sub_41112C(&amp;input, dword_418008);</span><br><span class="line">      --dword_418008;</span><br><span class="line">      Sleep(<span class="number">0x64</span>u);</span><br><span class="line">    &#125;</span><br><span class="line">    ReleaseMutex(hObject);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">//sub_41112C函数(套了一层)：</span></span><br><span class="line"><span class="function"><span class="keyword">char</span> *__cdecl <span class="title">sub_411940</span><span class="params">(<span class="keyword">char</span> *input, <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> *result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> v3; <span class="comment">// [esp+D3h] [ebp-5h]</span></span><br><span class="line"></span><br><span class="line">  v3 = input[a2];</span><br><span class="line">  <span class="keyword">if</span> ( (v3 &lt; <span class="number">97</span> || v3 &gt; <span class="number">122</span>) &amp;&amp; (v3 &lt; <span class="number">65</span> || v3 &gt; <span class="number">90</span>) )</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  <span class="keyword">if</span> ( v3 &lt; <span class="number">97</span> || v3 &gt; <span class="number">122</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    result = off_418000[<span class="number">0</span>];</span><br><span class="line">    input[a2] = off_418000[<span class="number">0</span>][input[a2] - <span class="number">38</span>];</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    result = off_418000[<span class="number">0</span>];</span><br><span class="line">    input[a2] = off_418000[<span class="number">0</span>][input[a2] - <span class="number">96</span>];</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>如果是小写，当前字符的ascii减96之后到off_418000查；如果是大写，减38</p>
<p>第二个线程：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __stdcall <span class="title">sub_411B10</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    WaitForSingleObject(hObject, <span class="number">0xFFFFFFFF</span>);</span><br><span class="line">    <span class="keyword">if</span> ( dword_418008 &gt; <span class="number">-1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      Sleep(<span class="number">0x64</span>u);</span><br><span class="line">      --dword_418008;</span><br><span class="line">    &#125;</span><br><span class="line">    ReleaseMutex(hObject);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>各一个字符加密，好家伙幸亏之前看过Windows程序设计，要不然还真可能看不懂.</p>
<p>再之后的有个与本地字符串的比较：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">sub_411880</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+D0h] [ebp-8h]</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt; <span class="number">29</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( input[i] != off_418004[i] )</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;\nflag&#123;%s&#125;\n\n&quot;</span>, Destination);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>只比较了29位，但是一共有30位，尝试到E正好可以：exp</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line">off_418000 = <span class="string">&#x27;QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm&#x27;</span></span><br><span class="line">off_418004 = <span class="string">&#x27;TOiZiZtOrYaToUwPnToBsOaOapsyS&#x27;</span></span><br><span class="line"><span class="built_in">str</span> = <span class="string">&#x27;&#x27;</span></span><br><span class="line">a = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(off_418004)):</span><br><span class="line">    <span class="keyword">if</span> i % <span class="number">2</span> == <span class="number">0</span>:</span><br><span class="line">        <span class="built_in">print</span>(off_418004[i], end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">        <span class="keyword">continue</span></span><br><span class="line">    <span class="keyword">if</span> off_418004[i].isupper():</span><br><span class="line">        a = <span class="built_in">chr</span>(off_418000.find(off_418004[i])+<span class="number">96</span>)</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        a = <span class="built_in">chr</span>(off_418000.find(off_418004[i])+<span class="number">38</span>)</span><br><span class="line">    <span class="built_in">print</span>(a, end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    <span class="comment"># i += 1</span></span><br><span class="line"><span class="comment">#ThisisthreadofwindowshahaIsES</span></span><br><span class="line"><span class="comment">#y</span></span><br></pre></td></tr></table></figure>

<h1 id="0x0D-WUSTCTF2020-level1"><a href="#0x0D-WUSTCTF2020-level1" class="headerlink" title="0x0D.[WUSTCTF2020]level1"></a>0x0D.[WUSTCTF2020]level1</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+4h] [rbp-2Ch]</span></span><br><span class="line">  FILE *stream; <span class="comment">// [rsp+8h] [rbp-28h]</span></span><br><span class="line">  <span class="keyword">char</span> ptr[<span class="number">24</span>]; <span class="comment">// [rsp+10h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v7; <span class="comment">// [rsp+28h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v7 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  stream = fopen(<span class="string">&quot;flag&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  fread(ptr, <span class="number">1uLL</span>, <span class="number">0x14</span>uLL, stream);</span><br><span class="line">  fclose(stream);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">1</span>; i &lt;= <span class="number">19</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( (i &amp; <span class="number">1</span>) != <span class="number">0</span> )</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;%ld\n&quot;</span>, (ptr[i] &lt;&lt; i));</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;%ld\n&quot;</span>, (i * ptr[i]));</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>就是将output的文件逆一遍，注意上面是从1开始的</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line">a = [<span class="number">198</span>,</span><br><span class="line">     <span class="number">232</span>,</span><br><span class="line">     <span class="number">816</span>,</span><br><span class="line">     <span class="number">200</span>,</span><br><span class="line">     <span class="number">1536</span>,</span><br><span class="line">     <span class="number">300</span>,</span><br><span class="line">     <span class="number">6144</span>,</span><br><span class="line">     <span class="number">984</span>,</span><br><span class="line">     <span class="number">51200</span>,</span><br><span class="line">     <span class="number">570</span>,</span><br><span class="line">     <span class="number">92160</span>,</span><br><span class="line">     <span class="number">1200</span>,</span><br><span class="line">     <span class="number">565248</span>,</span><br><span class="line">     <span class="number">756</span>,</span><br><span class="line">     <span class="number">1474560</span>,</span><br><span class="line">     <span class="number">800</span>,</span><br><span class="line">     <span class="number">6291456</span>,</span><br><span class="line">     <span class="number">1782</span>,</span><br><span class="line">     <span class="number">65536000</span>]</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(a)):</span><br><span class="line">    <span class="keyword">if</span> (i+<span class="number">1</span>) &amp; <span class="number">1</span> == <span class="number">0</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="built_in">chr</span>(a[i]//(i+<span class="number">1</span>)), end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="built_in">print</span>(<span class="built_in">chr</span>(a[i] &gt;&gt; (i+<span class="number">1</span>)), end=<span class="string">&#x27;&#x27;</span>)</span><br></pre></td></tr></table></figure>

<h1 id="0x0E-ACTF新生赛2020-usualCrypt"><a href="#0x0E-ACTF新生赛2020-usualCrypt" class="headerlink" title="0x0E.[ACTF新生赛2020]usualCrypt"></a>0x0E.[ACTF新生赛2020]usualCrypt</h1><p>ida识别的很多东西都有问题，改了很多</p>
<p>main：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> v5[<span class="number">12</span>]; <span class="comment">// [esp+8h] [ebp-74h] BYREF</span></span><br><span class="line">  __int16 v6; <span class="comment">// [esp+14h] [ebp-68h]</span></span><br><span class="line">  <span class="keyword">char</span> v7; <span class="comment">// [esp+16h] [ebp-66h]</span></span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">100</span>]; <span class="comment">// [esp+18h] [ebp-64h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">puts</span>(aGiveMeYourFlag);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, input);</span><br><span class="line">  *v5 = <span class="number">0</span>;</span><br><span class="line">  *&amp;v5[<span class="number">4</span>] = <span class="number">0</span>;</span><br><span class="line">  *&amp;v5[<span class="number">8</span>] = <span class="number">0</span>;</span><br><span class="line">  v6 = <span class="number">0</span>;</span><br><span class="line">  v7 = <span class="number">0</span>;</span><br><span class="line">  sub_401080(input, <span class="built_in">strlen</span>(input), v5);</span><br><span class="line">  v3 = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">while</span> ( v5[v3] == aZmxhz3tignxlxj[v3] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( ++v3 &gt; <span class="built_in">strlen</span>(v5) )</span><br><span class="line">      <span class="keyword">goto</span> LABEL_6;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">puts</span>(aError);</span><br><span class="line">LABEL_6:</span><br><span class="line">  <span class="keyword">if</span> ( v3 - <span class="number">1</span> == <span class="built_in">strlen</span>(aZmxhz3tignxlxj) )</span><br><span class="line">      <span class="comment">//zMXHz3TIgnxLxJhFAdtZn2fFk3lYCrtPC2l9</span></span><br><span class="line">    result = <span class="built_in">puts</span>(aAreYouHappyYes);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    result = <span class="built_in">puts</span>(aAreYouHappyNo);</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中的sub_401080:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">sub_401080</span><span class="params">(<span class="keyword">char</span> *a1, <span class="keyword">int</span> a2, <span class="keyword">int</span> *a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// edi</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// edx</span></span><br><span class="line">  <span class="keyword">char</span> *v6; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">int</span> v7; <span class="comment">// ecx</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v9; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v10; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v11; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">char</span> *v12; <span class="comment">// ecx</span></span><br><span class="line">  <span class="keyword">int</span> v13; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v15; <span class="comment">// [esp+18h] [ebp+8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = <span class="number">0</span>;</span><br><span class="line">  v4 = <span class="number">0</span>;</span><br><span class="line">  sub_401000();</span><br><span class="line">  v5 = a2 % <span class="number">3</span>;</span><br><span class="line">  v6 = a1;</span><br><span class="line">  v7 = a2 - a2 % <span class="number">3</span>;</span><br><span class="line">  v15 = a2 % <span class="number">3</span>;</span><br><span class="line">  <span class="keyword">if</span> ( v7 &gt; <span class="number">0</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">do</span></span><br><span class="line">    &#123;</span><br><span class="line">      LOBYTE(v5) = a1[v3];</span><br><span class="line">      v3 += <span class="number">3</span>;</span><br><span class="line">      v8 = v4 + <span class="number">1</span>;</span><br><span class="line">      *(a3 + v8 - <span class="number">1</span>) = aAbcdefghijklmn[(v5 &gt;&gt; <span class="number">2</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">      *(a3 + v8++) = aAbcdefghijklmn[<span class="number">16</span> * (a1[v3 - <span class="number">3</span>] &amp; <span class="number">3</span>) + ((a1[v3 - <span class="number">2</span>] &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0xF</span>)];</span><br><span class="line">      *(a3 + v8++) = aAbcdefghijklmn[<span class="number">4</span> * (a1[v3 - <span class="number">2</span>] &amp; <span class="number">0xF</span>) + ((a1[v3 - <span class="number">1</span>] &gt;&gt; <span class="number">6</span>) &amp; <span class="number">3</span>)];</span><br><span class="line">      v5 = a1[v3 - <span class="number">1</span>] &amp; <span class="number">0x3F</span>;</span><br><span class="line">      v4 = v8 + <span class="number">1</span>;</span><br><span class="line">      *(a3 + v4 - <span class="number">1</span>) = aAbcdefghijklmn[v5];</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">while</span> ( v3 &lt; v7 );</span><br><span class="line">    v5 = v15;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( v5 == <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    LOBYTE(v7) = a1[v3];</span><br><span class="line">    v9 = v4 + <span class="number">1</span>;</span><br><span class="line">    *(a3 + v9 - <span class="number">1</span>) = aAbcdefghijklmn[(v7 &gt;&gt; <span class="number">2</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v10 = v9 + <span class="number">1</span>;</span><br><span class="line">    *(a3 + v10 - <span class="number">1</span>) = aAbcdefghijklmn[<span class="number">16</span> * (a1[v3] &amp; <span class="number">3</span>)];</span><br><span class="line">    *(a3 + v10) = <span class="number">61</span>;</span><br><span class="line">LABEL_8:</span><br><span class="line">    v13 = v10 + <span class="number">1</span>;</span><br><span class="line">    *(a3 + v13) = <span class="number">61</span>;</span><br><span class="line">    v4 = v13 + <span class="number">1</span>;</span><br><span class="line">    <span class="keyword">goto</span> LABEL_9;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( v5 == <span class="number">2</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    v11 = v4 + <span class="number">1</span>;</span><br><span class="line">    *(a3 + v11 - <span class="number">1</span>) = aAbcdefghijklmn[(a1[v3] &gt;&gt; <span class="number">2</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v12 = &amp;a1[v3 + <span class="number">1</span>];</span><br><span class="line">    LOBYTE(v6) = *v12;</span><br><span class="line">    v10 = v11 + <span class="number">1</span>;</span><br><span class="line">    *(a3 + v10 - <span class="number">1</span>) = aAbcdefghijklmn[<span class="number">16</span> * (a1[v3] &amp; <span class="number">3</span>) + ((v6 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0xF</span>)];</span><br><span class="line">    *(a3 + v10) = aAbcdefghijklmn[<span class="number">4</span> * (*v12 &amp; <span class="number">0xF</span>)];</span><br><span class="line">    <span class="keyword">goto</span> LABEL_8;</span><br><span class="line">  &#125;</span><br><span class="line">LABEL_9:</span><br><span class="line">  *(a3 + v4) = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">return</span> sub_401030(a3);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">sub_401000</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> v1; <span class="comment">// cl</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">for</span> ( result = <span class="number">6</span>; result &lt; <span class="number">15</span>; ++result )</span><br><span class="line">  &#123;</span><br><span class="line">    v1 = aAbcdefghijklmn[result + <span class="number">10</span>];</span><br><span class="line">    aAbcdefghijklmn[result + <span class="number">10</span>] = aAbcdefghijklmn[result];</span><br><span class="line">    aAbcdefghijklmn[result] = v1;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> *__cdecl <span class="title">sub_401030</span><span class="params">(<span class="keyword">char</span> *input)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 v1; <span class="comment">// rax</span></span><br><span class="line">  <span class="keyword">char</span> v2; <span class="comment">// al</span></span><br><span class="line"></span><br><span class="line">  v1 = <span class="number">0</span>i64;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="built_in">strlen</span>(input) )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">do</span></span><br><span class="line">    &#123;</span><br><span class="line">      v2 = input[HIDWORD(v1)];</span><br><span class="line">      <span class="keyword">if</span> ( v2 &lt; <span class="number">97</span> || v2 &gt; <span class="number">122</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( v2 &lt; <span class="number">65</span> || v2 &gt; <span class="number">90</span> )</span><br><span class="line">          <span class="keyword">goto</span> LABEL_9;</span><br><span class="line">        LOBYTE(v1) = v2 + <span class="number">32</span>;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">      &#123;</span><br><span class="line">        LOBYTE(v1) = v2 - <span class="number">32</span>;</span><br><span class="line">      &#125;</span><br><span class="line">      input[HIDWORD(v1)] = v1;</span><br><span class="line">LABEL_9:</span><br><span class="line">      LODWORD(v1) = <span class="number">0</span>;</span><br><span class="line">      ++HIDWORD(v1);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">while</span> ( HIDWORD(v1) &lt; <span class="built_in">strlen</span>(input) );</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> v1;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>sub_401080主要是三部分：</p>
<ul>
<li>sub_401000：换base64表</li>
<li>base64</li>
<li>大小写转换的操作</li>
</ul>
<p>也就是说，我们拿本地的str先大小写转换，换表，在decode就OK</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> base64</span><br><span class="line"><span class="built_in">str</span> = <span class="string">&#x27;zMXHz3TIgnxLxJhFAdtZn2fFk3lYCrtPC2l9&#x27;</span>.swapcase()</span><br><span class="line">base = <span class="string">&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span></span><br><span class="line">A2Z = <span class="string">&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span></span><br><span class="line">base = <span class="built_in">list</span>(base)</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">6</span>, <span class="number">15</span>):</span><br><span class="line">    a = base[i]</span><br><span class="line">    base[i] = base[i+<span class="number">10</span>]</span><br><span class="line">    base[i+<span class="number">10</span>] = a</span><br><span class="line"></span><br><span class="line">base = <span class="string">&#x27;&#x27;</span>.join(base)</span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(<span class="built_in">str</span>)):</span><br><span class="line">    flag += A2Z[base.find(<span class="built_in">str</span>[i])]</span><br><span class="line">    <span class="built_in">print</span>(A2Z[base.find(<span class="built_in">str</span>[i])], end=<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">b = base64.b64decode(flag)</span><br><span class="line"><span class="built_in">print</span>(b)</span><br></pre></td></tr></table></figure>

<h1 id="0x0F-MRCTF2020-Transform"><a href="#0x0F-MRCTF2020-Transform" class="headerlink" title="0x0F.[MRCTF2020]Transform"></a>0x0F.[MRCTF2020]Transform</h1><p>无壳：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">104</span>]; <span class="comment">// [rsp+20h] [rbp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> j; <span class="comment">// [rsp+88h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+8Ch] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  sub_402230();</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Give me your code:\n&quot;</span>);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, input);</span><br><span class="line">  <span class="keyword">if</span> ( <span class="built_in">strlen</span>(input) != <span class="number">33</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Wrong!\n&quot;</span>);</span><br><span class="line">    system(<span class="string">&quot;pause&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">32</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    aHknvfymgQbpaJ[i] = input[asc_40F040[i]];</span><br><span class="line">    aHknvfymgQbpaJ[i] ^= LOBYTE(asc_40F040[i]);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">for</span> ( j = <span class="number">0</span>; j &lt;= <span class="number">32</span>; ++j )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( local_str[j] != aHknvfymgQbpaJ[j] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Wrong!\n&quot;</span>);</span><br><span class="line">      system(<span class="string">&quot;pause&quot;</span>);</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Right!Good Job!\n&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Here is your flag: %s\n&quot;</span>, input);</span><br><span class="line">  system(<span class="string">&quot;pause&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>长度是33，之后和本地的一个表异或，再等于另一个字符串</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line">table = [<span class="number">9</span>,<span class="number">10</span>,<span class="number">15</span>, <span class="number">23</span>,<span class="number">7</span>,</span><br><span class="line">         <span class="number">24</span>,<span class="number">12</span>, <span class="number">6</span>, <span class="number">1</span>,</span><br><span class="line">         <span class="number">16</span>,<span class="number">3</span>,<span class="number">17</span>, <span class="number">32</span>, <span class="number">29</span>, <span class="number">11</span>,<span class="number">30</span>,</span><br><span class="line">         <span class="number">27</span>, <span class="number">22</span>,</span><br><span class="line">         <span class="number">4</span>,<span class="number">13</span>, <span class="number">19</span>, <span class="number">20</span>,</span><br><span class="line">         <span class="number">21</span>,</span><br><span class="line">         <span class="number">2</span>,</span><br><span class="line">         <span class="number">25</span>,</span><br><span class="line">         <span class="number">5</span>,</span><br><span class="line">         <span class="number">31</span>,</span><br><span class="line">         <span class="number">8</span>,</span><br><span class="line">         <span class="number">18</span>,</span><br><span class="line">         <span class="number">26</span>,</span><br><span class="line">         <span class="number">28</span>,</span><br><span class="line">         <span class="number">14</span>, <span class="number">0</span>]</span><br><span class="line"></span><br><span class="line">local_str = [</span><br><span class="line">    <span class="number">0x67</span>, <span class="number">0x79</span>, <span class="number">0x7B</span>, <span class="number">0x7F</span>, <span class="number">0x75</span>, <span class="number">0x2B</span>, <span class="number">0x3C</span>, <span class="number">0x52</span>, <span class="number">0x53</span>, <span class="number">0x79</span>,</span><br><span class="line">    <span class="number">0x57</span>, <span class="number">0x5E</span>, <span class="number">0x5D</span>, <span class="number">0x42</span>, <span class="number">0x7B</span>, <span class="number">0x2D</span>, <span class="number">0x2A</span>, <span class="number">0x66</span>, <span class="number">0x42</span>, <span class="number">0x7E</span>,</span><br><span class="line">    <span class="number">0x4C</span>, <span class="number">0x57</span>, <span class="number">0x79</span>, <span class="number">0x41</span>, <span class="number">0x6B</span>, <span class="number">0x7E</span>, <span class="number">0x65</span>, <span class="number">0x3C</span>, <span class="number">0x5C</span>, <span class="number">0x45</span>,</span><br><span class="line">    <span class="number">0x6F</span>, <span class="number">0x62</span>, <span class="number">0x4D</span>]</span><br><span class="line">flag = [<span class="number">0</span>]*<span class="number">33</span></span><br><span class="line"><span class="built_in">print</span>(<span class="built_in">len</span>(table))</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(local_str)):</span><br><span class="line">    local_str[i] ^= table[i]</span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">33</span>):</span><br><span class="line">    flag[table[i]] = local_str[i]</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> flag:</span><br><span class="line">    <span class="built_in">print</span>(<span class="built_in">chr</span>(i), end=<span class="string">&#x27;&#x27;</span>)</span><br></pre></td></tr></table></figure>

<h1 id="0x10-相册"><a href="#0x10-相册" class="headerlink" title="0x10.相册"></a>0x10.相册</h1><p>根据提示说是和邮箱有关，jadx打开搜mail，有个<code>sendMailByJavaMail</code>，且第一个参数的含义大概为sendto的邮箱地址，查找交叉引用。</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029182421975.png" alt="image-20211029182421975"></p>
<p>发现有个mailserver的东西，大概率就是了，反查定义，：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029182507735.png" alt="image-20211029182507735"></p>
<p>base64解码了一下。</p>
<p>Java中NativeMethod一般用于调用外部文件，ida打开libcore.so，查看导出(export)，</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029182804375.png" alt="image-20211029182804375"></p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029183044566.png" alt="image-20211029183044566"></p>
<p>base64解一下就好了</p>
<h1 id="0x11-WUSTCTF2020-level2"><a href="#0x11-WUSTCTF2020-level2" class="headerlink" title="0x11.[WUSTCTF2020]level2"></a>0x11.[WUSTCTF2020]level2</h1><p>就脱个upx就OK</p>
<h1 id="0x12-HDCTF2019-Maze"><a href="#0x12-HDCTF2019-Maze" class="headerlink" title="0x12.[HDCTF2019]Maze"></a>0x12.[HDCTF2019]Maze</h1><p>这个题学到知识点了。</p>
<p>忘了有没有壳了，有也是upx，脱了就行</p>
<p>ida查看是这样：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029232619651.png" alt="image-20211029232619651"></p>
<p>main下面有一堆数据，f5不了；而且上面有个jnz的指令，相当于没跳转，而call的也是个乱的地址。这段代码加了花指令，ida分析错了。</p>
<p>首先将jnz给nop掉，可以直接ida也可od：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029232903932.png" alt="image-20211029232903932"></p>
<p>之后是call，当然不能全nop，后面可能会有代码，按d转为字节数据：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029233029066.png" alt="image-20211029233029066"></p>
<p>然后一步步测试改为nop，之后会发现ida自动就把后面给显示为了代码，但是还是不能f5：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211029233330994.png" alt="image-20211029233330994"></p>
<p>这是因为这块还不是函数，之后将红色的text选中按p，将这块弄为函数，之后就可f5了，简单的迷宫题：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+10h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> flag[<span class="number">16</span>]; <span class="comment">// [esp+14h] [ebp-10h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Go through the maze to get the flag!\n&quot;</span>);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%14s&quot;</span>, flag);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">13</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">switch</span> ( flag[i] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="string">&#x27;a&#x27;</span>:</span><br><span class="line">        --*asc_408078;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="string">&#x27;d&#x27;</span>:</span><br><span class="line">        ++*asc_408078;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="string">&#x27;s&#x27;</span>:</span><br><span class="line">        --dword_40807C;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="string">&#x27;w&#x27;</span>:</span><br><span class="line">        ++dword_40807C;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">default</span>:</span><br><span class="line">        <span class="keyword">continue</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">    <span class="comment">//初始分别为7和0</span></span><br><span class="line">  <span class="keyword">if</span> ( *asc_408078 == <span class="number">5</span> &amp;&amp; dword_40807C == <span class="number">-4</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Congratulations!\n&quot;</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Here is the flag:flag&#123;%s&#125;\n&quot;</span>, flag);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Try again...\n&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>迷宫如下:</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">*******+**</span><br><span class="line">******* **</span><br><span class="line">****    **</span><br><span class="line">**   *****</span><br><span class="line">** **F****</span><br><span class="line">**    ****</span><br><span class="line">**********</span><br><span class="line">//ssaaasaassdddw</span><br></pre></td></tr></table></figure>

<h1 id="0X13-GWCTF-2019-xxor（未完）"><a href="#0X13-GWCTF-2019-xxor（未完）" class="headerlink" title="0X13.[GWCTF 2019]xxor（未完）"></a>0X13.[GWCTF 2019]xxor（未完）</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+8h] [rbp-68h]</span></span><br><span class="line">  <span class="keyword">int</span> j; <span class="comment">// [rsp+Ch] [rbp-64h]</span></span><br><span class="line">  __int64 v6[<span class="number">6</span>]; <span class="comment">// [rsp+10h] [rbp-60h] BYREF</span></span><br><span class="line">  __int64 v7[<span class="number">6</span>]; <span class="comment">// [rsp+40h] [rbp-30h] BYREF</span></span><br><span class="line"></span><br><span class="line">  v7[<span class="number">5</span>] = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Let us play a game?&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;you have six chances to input&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Come on!&quot;</span>);</span><br><span class="line">  v6[<span class="number">0</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v6[<span class="number">1</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v6[<span class="number">2</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v6[<span class="number">3</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v6[<span class="number">4</span>] = <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">5</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>, <span class="string">&quot;input: &quot;</span>);</span><br><span class="line">    a2 = (v6 + <span class="number">4</span> * i);</span><br><span class="line">    __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, a2);</span><br><span class="line">  &#125;</span><br><span class="line">  v7[<span class="number">0</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v7[<span class="number">1</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v7[<span class="number">2</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v7[<span class="number">3</span>] = <span class="number">0LL</span>;</span><br><span class="line">  v7[<span class="number">4</span>] = <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">for</span> ( j = <span class="number">0</span>; j &lt;= <span class="number">2</span>; ++j )</span><br><span class="line">  &#123;</span><br><span class="line">    dword_601078 = v6[j];</span><br><span class="line">    dword_60107C = HIDWORD(v6[j]);</span><br><span class="line">    a2 = &amp;unk_601060;</span><br><span class="line">    sub_400686(&amp;dword_601078, &amp;unk_601060);</span><br><span class="line">    LODWORD(v7[j]) = dword_601078;</span><br><span class="line">    HIDWORD(v7[j]) = dword_60107C;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( sub_400770(v7, a2) != <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;NO NO NO~ &quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Congratulation!\n&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;You seccess half\n&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Do not forget to change input to hex and combine~\n&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;ByeBye&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>首先是输入，然后进行了一个变换，再进行了一次判断。</p>
<p>先看判断：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_400770</span><span class="params">(_DWORD *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( a1[<span class="number">2</span>] - a1[<span class="number">3</span>] == <span class="number">2225223423LL</span></span><br><span class="line">    &amp;&amp; a1[<span class="number">3</span>] + a1[<span class="number">4</span>] == <span class="number">4201428739LL</span></span><br><span class="line">    &amp;&amp; a1[<span class="number">2</span>] - a1[<span class="number">4</span>] == <span class="number">1121399208LL</span></span><br><span class="line">    &amp;&amp; *a1 == <span class="number">-548868226</span></span><br><span class="line">    &amp;&amp; a1[<span class="number">5</span>] == <span class="number">-2064448480</span></span><br><span class="line">    &amp;&amp; a1[<span class="number">1</span>] == <span class="number">550153460</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;good!&quot;</span>);</span><br><span class="line">    result = <span class="number">1LL</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Wrong!&quot;</span>);</span><br><span class="line">    result = <span class="number">0LL</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>使用z3简单算下：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> z3 <span class="keyword">import</span> *</span><br><span class="line">s = Solver()</span><br><span class="line">a1 = [<span class="number">0</span>]*<span class="number">6</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">6</span>):</span><br><span class="line">    a1[i] = Int(<span class="string">&#x27;a1[&#x27;</span>+<span class="built_in">str</span>(i)+<span class="string">&#x27;]&#x27;</span>)</span><br><span class="line">s.add(a1[<span class="number">2</span>] - a1[<span class="number">3</span>] == <span class="number">0x84A236FF</span>)</span><br><span class="line">s.add(a1[<span class="number">3</span>] + a1[<span class="number">4</span>] == <span class="number">0xFA6CB703</span>)</span><br><span class="line">s.add(a1[<span class="number">2</span>] - a1[<span class="number">4</span>] == <span class="number">1121399208</span>)</span><br><span class="line">s.add(a1[<span class="number">0</span>] == -<span class="number">548868226</span>)</span><br><span class="line">s.add(a1[<span class="number">5</span>] == -<span class="number">2064448480</span>)</span><br><span class="line">s.add(a1[<span class="number">1</span>] == <span class="number">550153460</span>)</span><br><span class="line">s.check()</span><br><span class="line"><span class="built_in">print</span>(s.model())</span><br></pre></td></tr></table></figure>

<p>得到：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">a1[2] = 3774025685,</span><br><span class="line"> a1[1] = 550153460,</span><br><span class="line"> a1[5] = -2064448480,</span><br><span class="line"> a1[0] = -548868226,</span><br><span class="line"> a1[3] = 1548802262,</span><br><span class="line"> a1[4] = 2652626477</span><br></pre></td></tr></table></figure>

<p>之后往前看是：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_400686</span><span class="params">(<span class="keyword">unsigned</span> <span class="keyword">int</span> *temp, <span class="keyword">int</span> *table)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v3; <span class="comment">// [rsp+1Ch] [rbp-24h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v4; <span class="comment">// [rsp+20h] [rbp-20h]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [rsp+24h] [rbp-1Ch]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> i; <span class="comment">// [rsp+28h] [rbp-18h]</span></span><br><span class="line"></span><br><span class="line">  v3 = *temp;</span><br><span class="line">  v4 = temp[<span class="number">1</span>];</span><br><span class="line">  v5 = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">0x3F</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    v5 += <span class="number">0x458BCD42</span>;</span><br><span class="line">    v3 += (v4 + v5 + <span class="number">11</span>) ^ ((v4 &lt;&lt; <span class="number">6</span>) + *table) ^ ((v4 &gt;&gt; <span class="number">9</span>) + table[<span class="number">1</span>]) ^ <span class="number">0x20</span>;</span><br><span class="line">    v4 += (v3 + v5 + <span class="number">20</span>) ^ ((v3 &lt;&lt; <span class="number">6</span>) + table[<span class="number">2</span>]) ^ ((v3 &gt;&gt; <span class="number">9</span>) + table[<span class="number">3</span>]) ^ <span class="number">0x10</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  *temp = v3;</span><br><span class="line">  result = v4;</span><br><span class="line">  temp[<span class="number">1</span>] = v4;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>我看网上都是c写的，想试试py，但是还要看其他的内容，先鸽了</p>
<h1 id="0x14-MRCTF2020-Xor"><a href="#0x14-MRCTF2020-Xor" class="headerlink" title="0x14.[MRCTF2020]Xor"></a>0x14.[MRCTF2020]Xor</h1><p>简单的一个异或：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">local = [<span class="number">0x4D</span>, <span class="number">0x53</span>, <span class="number">0x41</span>, <span class="number">0x57</span>, <span class="number">0x42</span>, <span class="number">0x7E</span>, <span class="number">0x46</span>, <span class="number">0x58</span>, <span class="number">0x5A</span>, <span class="number">0x3A</span>,</span><br><span class="line">         <span class="number">0x4A</span>, <span class="number">0x3A</span>, <span class="number">0x60</span>, <span class="number">0x74</span>, <span class="number">0x51</span>, <span class="number">0x4A</span>, <span class="number">0x22</span>, <span class="number">0x4E</span>, <span class="number">0x40</span>, <span class="number">0x20</span>,</span><br><span class="line">         <span class="number">0x62</span>, <span class="number">0x70</span>, <span class="number">0x64</span>, <span class="number">0x64</span>, <span class="number">0x7D</span>, <span class="number">0x38</span>, <span class="number">0x67</span>]</span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(local)):</span><br><span class="line">    <span class="built_in">print</span>(<span class="built_in">chr</span>(i ^ local[i]), end=<span class="string">&#x27;&#x27;</span>)</span><br></pre></td></tr></table></figure>

<h1 id="0x15-FlareOn4-IgniteMe"><a href="#0x15-FlareOn4-IgniteMe" class="headerlink" title="0x15.[FlareOn4]IgniteMe"></a>0x15.[FlareOn4]IgniteMe</h1><p>无壳，打开</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __noreturn <span class="title">start</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  DWORD NumberOfBytesWritten; <span class="comment">// [esp+0h] [ebp-4h] BYREF</span></span><br><span class="line"></span><br><span class="line">  NumberOfBytesWritten = <span class="number">0</span>;</span><br><span class="line">  hFile = GetStdHandle(<span class="number">0xFFFFFFF6</span>);</span><br><span class="line">  dword_403074 = GetStdHandle(<span class="number">0xFFFFFFF5</span>);</span><br><span class="line">  WriteFile(dword_403074, aG1v3M3T3hFl4g, <span class="number">0x13</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  sub_4010F0();</span><br><span class="line">  <span class="keyword">if</span> ( sub_401050() )</span><br><span class="line">    WriteFile(dword_403074, aG00dJ0b, <span class="number">0xA</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    WriteFile(dword_403074, aN0tT00H0tRWe7r, <span class="number">0x24</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  ExitProcess(<span class="number">0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中的sub_4010F0就是去了\r和\n，下面是sub_401050：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">sub_401050</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> len; <span class="comment">// [esp+0h] [ebp-Ch]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+4h] [ebp-8h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> j; <span class="comment">// [esp+4h] [ebp-8h]</span></span><br><span class="line">  <span class="keyword">char</span> v4; <span class="comment">// [esp+Bh] [ebp-1h]</span></span><br><span class="line"></span><br><span class="line">  len = sub_401020(byte_403078);</span><br><span class="line">  v4 = sub_401000();</span><br><span class="line">  <span class="keyword">for</span> ( i = len - <span class="number">1</span>; i &gt;= <span class="number">0</span>; --i )</span><br><span class="line">  &#123;</span><br><span class="line">    byte_403180[i] = v4 ^ byte_403078[i];</span><br><span class="line">    v4 = byte_403078[i];</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">for</span> ( j = <span class="number">0</span>; j &lt; <span class="number">0x27</span>; ++j )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( byte_403180[j] != local_str[j] )</span><br><span class="line">      <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>又是个异或，且v4第一开始是4，调出来的，exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">local_str = [<span class="number">0x0D</span>, <span class="number">0x26</span>, <span class="number">0x49</span>, <span class="number">0x45</span>, <span class="number">0x2A</span>, <span class="number">0x17</span>, <span class="number">0x78</span>, <span class="number">0x44</span>, <span class="number">0x2B</span>, <span class="number">0x6C</span>,</span><br><span class="line">             <span class="number">0x5D</span>, <span class="number">0x5E</span>, <span class="number">0x45</span>, <span class="number">0x12</span>, <span class="number">0x2F</span>, <span class="number">0x17</span>, <span class="number">0x2B</span>, <span class="number">0x44</span>, <span class="number">0x6F</span>, <span class="number">0x6E</span>,</span><br><span class="line">             <span class="number">0x56</span>, <span class="number">0x09</span>, <span class="number">0x5F</span>, <span class="number">0x45</span>, <span class="number">0x47</span>, <span class="number">0x73</span>, <span class="number">0x26</span>, <span class="number">0x0A</span>, <span class="number">0x0D</span>, <span class="number">0x13</span>,</span><br><span class="line">             <span class="number">0x17</span>, <span class="number">0x48</span>, <span class="number">0x42</span>, <span class="number">0x01</span>, <span class="number">0x40</span>, <span class="number">0x4D</span>, <span class="number">0x0C</span>, <span class="number">0x02</span>, <span class="number">0x69</span>]</span><br><span class="line">local_str.reverse()</span><br><span class="line">v4 = <span class="number">4</span></span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">len</span>(local_str)):</span><br><span class="line">    flag += <span class="built_in">chr</span>(local_str[i] ^ v4)</span><br><span class="line">    v4 = local_str[i] ^ v4</span><br><span class="line"><span class="built_in">print</span>(flag[::-<span class="number">1</span>])</span><br></pre></td></tr></table></figure>

<h1 id="0x16-MRCTF2020-hello-world-go"><a href="#0x16-MRCTF2020-hello-world-go" class="headerlink" title="0x16.[MRCTF2020]hello_world_go"></a>0x16.[MRCTF2020]hello_world_go</h1><p>说实话没看懂在搞啥，就看到memequal和cmpstring两个函数就拿到flag了。</p>
<h1 id="0x17-WUSTCTF2020-level3"><a href="#0x17-WUSTCTF2020-level3" class="headerlink" title="0x17.[WUSTCTF2020]level3"></a>0x17.[WUSTCTF2020]level3</h1><p>是一个变表的base64，虽然能看到变表的函数，但是不知道在哪里调用的。。。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> base64</span><br><span class="line"><span class="keyword">import</span> <span class="built_in">string</span></span><br><span class="line">str0 = <span class="string">&quot;d2G0ZjLwHjS7DmOzZAY0X2lzX3CoZV9zdNOydO9vZl9yZXZlcnGlfD==&quot;</span></span><br><span class="line">string2 = <span class="string">&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span></span><br><span class="line">string1 = <span class="built_in">list</span>(</span><br><span class="line">    <span class="string">&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span>)</span><br><span class="line"><span class="keyword">for</span> i in range(<span class="number">10</span>):</span><br><span class="line">    string1[i], string1[<span class="number">19</span>-i] = string1[<span class="number">19</span>-i], string1[i]</span><br><span class="line"></span><br><span class="line">string1 = <span class="string">&#x27;&#x27;.join(string1)</span></span><br><span class="line"><span class="string">print(base64.b64decode(str0.translate(str.maketrans(string1, string2))))</span></span><br></pre></td></tr></table></figure>

<h1 id="0x18-WUSTCTF2020-Cr0ssfun"><a href="#0x18-WUSTCTF2020-Cr0ssfun" class="headerlink" title="0x18.[WUSTCTF2020]Cr0ssfun"></a>0x18.[WUSTCTF2020]Cr0ssfun</h1><p>check里面啥都有</p>
<h1 id="0x19-FlareOn6-Overlong"><a href="#0x19-FlareOn6-Overlong" class="headerlink" title="0x19.[FlareOn6]Overlong"></a>0x19.[FlareOn6]Overlong</h1><p>ida不太会改，就od了，首先他是因为push了1c的长度，而需要显示的长度远大于0x1c，所以将它改大一些就OK，这里直接在stack上改的：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211031173412785.png" alt="image-20211031173412785"></p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211031173430925.png" alt="image-20211031173430925"></p>
<h1 id="0x1A-BJDCTF2020-BJD-hamburger-competition"><a href="#0x1A-BJDCTF2020-BJD-hamburger-competition" class="headerlink" title="0x1A.[BJDCTF2020]BJD hamburger competition"></a>0x1A.[BJDCTF2020]BJD hamburger competition</h1><blockquote>
<p>  <strong>识别Unity游戏</strong></p>
<p>  Android平台的apk包可以直接解压，看是否有.&#x2F;assets&#x2F;bin&#x2F;Data&#x2F;Managed目录，也可以查看lib文件夹下面包含的一些so，如果有libmono,libunity等模块，基本可以确定是unity游戏了。</p>
<p>  Android平台中C#编写的主逻辑模块代码静态编辑之后存储于Assembly-CSharp.dll文件中。因为unity的跨平台，Android平台是unity编译的游戏，那么其对应的IOS平台上也是unity编译出来的。如果希望直接从IOS上面去看是否是unity游戏，可以提取游戏中的主模块查看是否有unity之类的函数即可。</p>
<p>  转自：<a target="_blank" rel="noopener" href="https://www.52pojie.cn/thread-495115-1-1.html">https://www.52pojie.cn/thread-495115-1-1.html</a></p>
</blockquote>
<p>第一次做unity的题，unity是C++写的，所以这里使用dnspy直接看源码，在BJD hamburger competition_Data\Managed文件夹中找到Assembly-CSharp.dll（进去文件后第一个就是），这个dll文件是程序的源码，用来存放C++工程。</p>
<p>Assembly-CSharp.dll这个文件很重要。</p>
<p>之后在buttonspawnfruit看到：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211031175420892.png" alt="image-20211031175420892"></p>
<p>解密之后md5，要注意的是md5返回的是前20位：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211031175939675.png" alt="image-20211031175939675"></p>
<h1 id="0x1B-ACTF新生赛2020-Oruga"><a href="#0x1B-ACTF新生赛2020-Oruga" class="headerlink" title="0x1B.[ACTF新生赛2020]Oruga"></a>0x1B.[ACTF新生赛2020]Oruga</h1><p>重点在sub_78A</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+0h] [rbp-40h]</span></span><br><span class="line">  <span class="keyword">char</span> s1[<span class="number">6</span>]; <span class="comment">// [rsp+4h] [rbp-3Ch] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> s2[<span class="number">6</span>]; <span class="comment">// [rsp+Ah] [rbp-36h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">40</span>]; <span class="comment">// [rsp+10h] [rbp-30h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v8; <span class="comment">// [rsp+38h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v8 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">memset</span>(input, <span class="number">0</span>, <span class="number">0x19</span>uLL);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Tell me the flag:&quot;</span>);</span><br><span class="line">  <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, input);</span><br><span class="line">  <span class="built_in">strcpy</span>(s2, <span class="string">&quot;actf&#123;&quot;</span>);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">4</span>; ++i )</span><br><span class="line">    s1[i] = input[i];</span><br><span class="line">  s1[<span class="number">5</span>] = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">if</span> ( !<span class="built_in">strcmp</span>(s1, s2) )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( sub_78A(input) )</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;That&#x27;s True Flag!&quot;</span>);</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;don&#x27;t stop trying...&quot;</span>);</span><br><span class="line">    result = <span class="number">0LL</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Format false!&quot;</span>);</span><br><span class="line">    result = <span class="number">0LL</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>sub_78A:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">_BOOL8 __fastcall <span class="title">sub_78A</span><span class="params">(<span class="keyword">char</span> *input)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> now; <span class="comment">// [rsp+Ch] [rbp-Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [rsp+10h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [rsp+14h] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  now = <span class="number">0</span>;</span><br><span class="line">  v3 = <span class="number">5</span>;</span><br><span class="line">  v4 = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">while</span> ( <span class="built_in">map</span>[now] != <span class="number">33</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    now -= v4;</span><br><span class="line">    <span class="keyword">if</span> ( input[v3] != <span class="string">&#x27;W&#x27;</span> || v4 == <span class="number">0xFFFFFFF0</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( input[v3] != <span class="string">&#x27;E&#x27;</span> || v4 == <span class="number">1</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( input[v3] != <span class="string">&#x27;M&#x27;</span> || v4 == <span class="number">0x10</span> )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="keyword">if</span> ( input[v3] != <span class="string">&#x27;J&#x27;</span> || v4 == <span class="number">0xFFFFFFFF</span> )</span><br><span class="line">            <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">          v4 = <span class="number">0xFFFFFFFF</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">else</span></span><br><span class="line">        &#123;</span><br><span class="line">          v4 = <span class="number">0x10</span>;</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">      &#123;</span><br><span class="line">        v4 = <span class="number">1</span>;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      v4 = <span class="number">0xFFFFFFF0</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    ++v3;</span><br><span class="line">    <span class="keyword">while</span> ( !<span class="built_in">map</span>[now] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v4 == <span class="number">-1</span> &amp;&amp; (now &amp; <span class="number">0xF</span>) == <span class="number">0</span> )       <span class="comment">// 在最左边</span></span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      <span class="keyword">if</span> ( v4 == <span class="number">1</span> &amp;&amp; now % <span class="number">16</span> == <span class="number">15</span> )          <span class="comment">// 在最右边</span></span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      <span class="keyword">if</span> ( v4 == <span class="number">0x10</span> &amp;&amp; (now - <span class="number">240</span>) &lt;= <span class="number">15</span> )    <span class="comment">// 在最后一行</span></span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      <span class="keyword">if</span> ( v4 == <span class="number">0xFFFFFFF0</span> &amp;&amp; (now + <span class="number">15</span>) &lt;= <span class="number">30</span> )<span class="comment">// 在第一行</span></span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      now += v4;                                <span class="comment">// 每次可以一直走</span></span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> input[v3] == <span class="string">&#x27;&#125;&#x27;</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>每次只要没撞到墙都可以一直走</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">unsigned</span> <span class="keyword">char</span> <span class="built_in">map</span>[] =</span><br><span class="line">&#123;</span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">35</span>,  <span class="number">35</span>,  <span class="number">35</span>,  <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">35</span>, </span><br><span class="line">   <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">   <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,  <span class="number">80</span>,  <span class="number">80</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">76</span>,   <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,  <span class="number">80</span>, </span><br><span class="line">   <span class="number">80</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">76</span>,   <span class="number">0</span>,  <span class="number">79</span>, </span><br><span class="line">   <span class="number">79</span>,   <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,  <span class="number">80</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">76</span>,  <span class="number">76</span>,   <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">80</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">79</span>,  <span class="number">79</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">80</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">   <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">   <span class="number">77</span>,  <span class="number">77</span>,  <span class="number">77</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">35</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">77</span>,  <span class="number">77</span>,  <span class="number">77</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">69</span>,  <span class="number">69</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">48</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">   <span class="number">69</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">69</span>,  <span class="number">69</span>,  <span class="number">84</span>,  <span class="number">84</span>, </span><br><span class="line">   <span class="number">84</span>,  <span class="number">73</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">69</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">84</span>,   <span class="number">0</span>,  <span class="number">73</span>,   <span class="number">0</span>,  <span class="number">77</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">69</span>,   <span class="number">0</span>, </span><br><span class="line">    <span class="number">0</span>,  <span class="number">84</span>,   <span class="number">0</span>,  <span class="number">73</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>,   <span class="number">0</span>,  <span class="number">77</span>, </span><br><span class="line">   <span class="number">33</span>,   <span class="number">0</span>,   <span class="number">0</span>,   <span class="number">0</span>,  <span class="number">69</span>,  <span class="number">69</span></span><br><span class="line">&#125;;</span><br><span class="line"><span class="comment">//MEWEMEWJMEWJM</span></span><br></pre></td></tr></table></figure>

<h1 id="0x1C-FlareOn3-Challenge1"><a href="#0x1C-FlareOn3-Challenge1" class="headerlink" title="0x1C.[FlareOn3]Challenge1"></a>0x1C.[FlareOn3]Challenge1</h1><p>无壳，</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> Buffer[<span class="number">128</span>]; <span class="comment">// [esp+0h] [ebp-94h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> *Str1; <span class="comment">// [esp+80h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> *Str2; <span class="comment">// [esp+84h] [ebp-10h]</span></span><br><span class="line">  HANDLE v7; <span class="comment">// [esp+88h] [ebp-Ch]</span></span><br><span class="line">  HANDLE hFile; <span class="comment">// [esp+8Ch] [ebp-8h]</span></span><br><span class="line">  DWORD NumberOfBytesWritten; <span class="comment">// [esp+90h] [ebp-4h] BYREF</span></span><br><span class="line"></span><br><span class="line">  hFile = GetStdHandle(<span class="number">0xFFFFFFF5</span>);</span><br><span class="line">  v7 = GetStdHandle(<span class="number">0xFFFFFFF6</span>);</span><br><span class="line">  Str2 = <span class="string">&quot;x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q&quot;</span>;</span><br><span class="line">  WriteFile(hFile, <span class="string">&quot;Enter password:\r\n&quot;</span>, <span class="number">0x12</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  ReadFile(v7, Buffer, <span class="number">0x80</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  Str1 = sub_401260(Buffer, NumberOfBytesWritten - <span class="number">2</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !<span class="built_in">strcmp</span>(Str1, Str2) )</span><br><span class="line">    WriteFile(hFile, <span class="string">&quot;Correct!\r\n&quot;</span>, <span class="number">0xB</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    WriteFile(hFile, <span class="string">&quot;Wrong password\r\n&quot;</span>, <span class="number">0x11</span>u, &amp;NumberOfBytesWritten, <span class="number">0</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function">_BYTE *__cdecl <span class="title">sub_401260</span><span class="params">(<span class="keyword">char</span> *input, DWORD size)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [esp+Ch] [ebp-24h]</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+10h] [ebp-20h]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [esp+14h] [ebp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+1Ch] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v7; <span class="comment">// [esp+20h] [ebp-10h]</span></span><br><span class="line">  _BYTE *v8; <span class="comment">// [esp+24h] [ebp-Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v9; <span class="comment">// [esp+28h] [ebp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> v10; <span class="comment">// [esp+28h] [ebp-8h]</span></span><br><span class="line">  DWORD v11; <span class="comment">// [esp+2Ch] [ebp-4h]</span></span><br><span class="line"></span><br><span class="line">  v8 = <span class="built_in">malloc</span>(<span class="number">4</span> * ((size + <span class="number">2</span>) / <span class="number">3</span>) + <span class="number">1</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !v8 )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  v11 = <span class="number">0</span>;</span><br><span class="line">  v9 = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">while</span> ( v11 &lt; size )</span><br><span class="line">  &#123;</span><br><span class="line">    v5 = input[v11];</span><br><span class="line">    <span class="keyword">if</span> ( ++v11 &gt;= size )</span><br><span class="line">      v4 = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      v4 = input[v11++];</span><br><span class="line">    <span class="keyword">if</span> ( v11 &gt;= size )</span><br><span class="line">      v3 = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      v3 = input[v11++];</span><br><span class="line">    v7 = v3 + (v5 &lt;&lt; <span class="number">16</span>) + (v4 &lt;&lt; <span class="number">8</span>);</span><br><span class="line">    v8[v9] = aZyxabcdefghijk[(v7 &gt;&gt; <span class="number">18</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v10 = v9 + <span class="number">1</span>;</span><br><span class="line">    v8[v10] = aZyxabcdefghijk[(v7 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v8[++v10] = aZyxabcdefghijk[(v7 &gt;&gt; <span class="number">6</span>) &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v8[++v10] = aZyxabcdefghijk[v3 &amp; <span class="number">0x3F</span>];</span><br><span class="line">    v9 = v10 + <span class="number">1</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt; *&amp;aZyxabcdefghijk[<span class="number">4</span> * (size % <span class="number">3</span>) + <span class="number">64</span>]; ++i )</span><br><span class="line">    v8[<span class="number">4</span> * ((size + <span class="number">2</span>) / <span class="number">3</span>) - i - <span class="number">1</span>] = <span class="string">&#x27;=&#x27;</span>;</span><br><span class="line">  v8[<span class="number">4</span> * ((size + <span class="number">2</span>) / <span class="number">3</span>)] = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">return</span> v8;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>变表的base64：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> base64</span><br><span class="line">str1 = <span class="string">&#x27;x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q&#x27;</span></span><br><span class="line">base = <span class="string">&#x27;ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/&#x27;</span></span><br><span class="line">table = <span class="string">&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span></span><br><span class="line">a = base64.b64decode(str1.translate(<span class="built_in">str</span>.maketrans(base, table)))</span><br><span class="line"><span class="built_in">print</span>(a)</span><br></pre></td></tr></table></figure>

<h1 id="0x1D-Zer0pts2020-easy-strcmp"><a href="#0x1D-Zer0pts2020-easy-strcmp" class="headerlink" title="0x1D.[Zer0pts2020]easy strcmp"></a>0x1D.[Zer0pts2020]easy strcmp</h1><p>又学到了个小东西，在main之前会先执行init，最后会fini也就是说：</p>
<p>在执行：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">if</span> ( a1 &gt; <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( !<span class="built_in">strcmp</span>(a2[<span class="number">1</span>], <span class="string">&quot;zer0pts&#123;********CENSORED********&#125;&quot;</span>) )</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Correct!&quot;</span>);</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Wrong!&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Usage: %s &lt;FLAG&gt;\n&quot;</span>, *a2);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>之前，先执行了init：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __fastcall <span class="title">init</span><span class="params">(<span class="keyword">unsigned</span> <span class="keyword">int</span> a1, __int64 a2, __int64 a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">signed</span> __int64 v4; <span class="comment">// rbp</span></span><br><span class="line">  __int64 i; <span class="comment">// rbx</span></span><br><span class="line"></span><br><span class="line">  v4 = &amp;off_200DF0 - &amp;funcs_889;</span><br><span class="line">  init_proc();</span><br><span class="line">  <span class="keyword">if</span> ( v4 )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0LL</span>; i != v4; ++i )</span><br><span class="line">      ((<span class="keyword">void</span> (__fastcall *)(_QWORD, __int64, __int64))*(&amp;funcs_889 + i))(a1, a2, a3);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>而这里面是执行了两个之间的所有函数：</p>
<p><img src="/2021/11/07/BUU-RE-0x01-0x1F/image-20211031232427647.png" alt="image-20211031232427647"></p>
<p>其中重要的就是795的那个函数了</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span> (**sub_795())(<span class="keyword">const</span> <span class="keyword">char</span> *s1, <span class="keyword">const</span> <span class="keyword">char</span> *s2)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">int</span> (**result)(<span class="keyword">const</span> <span class="keyword">char</span> *, <span class="keyword">const</span> <span class="keyword">char</span> *); <span class="comment">// rax</span></span><br><span class="line"></span><br><span class="line">  result = &amp;<span class="built_in">strcmp</span>;</span><br><span class="line">  qword_201090 = (__int64)&amp;<span class="built_in">strcmp</span>;</span><br><span class="line">  off_201028 = sub_6EA;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>吧strcmp的函数换为了sub_6EA，：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_6EA</span><span class="params">(__int64 a1, __int64 a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> j; <span class="comment">// [rsp+1Ch] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; *(_BYTE *)(i + a1); ++i )</span><br><span class="line">    ;</span><br><span class="line">  v4 = (i &gt;&gt; <span class="number">3</span>) + <span class="number">1</span>;</span><br><span class="line">  <span class="keyword">for</span> ( j = <span class="number">0</span>; j &lt; v4; ++j )</span><br><span class="line">    *(_QWORD *)(<span class="number">8</span> * j + a1) -= qword_201060[j];</span><br><span class="line">  <span class="keyword">return</span> qword_201090(a1, a2);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>网上的exp，怎么说呢，中间那块算的还是有问题</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> binascii</span><br><span class="line">enc = <span class="string">&quot;********CENSORED********&quot;</span></span><br><span class="line">m = [<span class="number">0x410A4335494A0942</span>, <span class="number">0x0B0EF2F50BE619F0</span>, <span class="number">0x4F0A3A064A35282B</span>]</span><br><span class="line">flag = <span class="string">b&#x27;&#x27;</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">3</span>):</span><br><span class="line">    p = enc[i*<span class="number">8</span>:(i+<span class="number">1</span>)*<span class="number">8</span>]</span><br><span class="line">    a = binascii.b2a_hex(p.encode(<span class="string">&#x27;ascii&#x27;</span>)[::-<span class="number">1</span>])</span><br><span class="line">    b = binascii.a2b_hex(<span class="built_in">hex</span>(<span class="built_in">int</span>(a, <span class="number">16</span>) + m[i])[<span class="number">2</span>:])[::-<span class="number">1</span>]</span><br><span class="line">    <span class="built_in">print</span>(a, b, <span class="built_in">hex</span>(m[i]))</span><br><span class="line">    flag += b</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>

<h1 id="0x1E-UTCTF2020-basic-re"><a href="#0x1E-UTCTF2020-basic-re" class="headerlink" title="0x1E.[UTCTF2020]basic-re"></a>0x1E.[UTCTF2020]basic-re</h1><p>字符串flag</p>
<h1 id="0x1F-ACTF新生赛2020-Universe-final-answer"><a href="#0x1F-ACTF新生赛2020-Universe-final-answer" class="headerlink" title="0x1F.[ACTF新生赛2020]Universe_final_answer"></a>0x1F.[ACTF新生赛2020]Universe_final_answer</h1><p>z3的题：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">bool</span> __fastcall <span class="title">sub_860</span><span class="params">(<span class="keyword">char</span> *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// ecx</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// edx</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// er9</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// er11</span></span><br><span class="line">  <span class="keyword">int</span> v6; <span class="comment">// ebp</span></span><br><span class="line">  <span class="keyword">int</span> v7; <span class="comment">// ebx</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// er8</span></span><br><span class="line">  <span class="keyword">int</span> v9; <span class="comment">// er10</span></span><br><span class="line">  <span class="keyword">bool</span> result; <span class="comment">// al</span></span><br><span class="line">  <span class="keyword">int</span> v11; <span class="comment">// [rsp+0h] [rbp-38h]</span></span><br><span class="line"></span><br><span class="line">  v1 = a1[<span class="number">1</span>];</span><br><span class="line">  v2 = *a1;</span><br><span class="line">  v3 = a1[<span class="number">2</span>];</span><br><span class="line">  v4 = a1[<span class="number">3</span>];</span><br><span class="line">  v5 = a1[<span class="number">4</span>];</span><br><span class="line">  v6 = a1[<span class="number">6</span>];</span><br><span class="line">  v7 = a1[<span class="number">5</span>];</span><br><span class="line">  v8 = a1[<span class="number">7</span>];</span><br><span class="line">  v9 = a1[<span class="number">8</span>];</span><br><span class="line">  result = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">if</span> ( <span class="number">-85</span> * v9 + <span class="number">58</span> * v8 + <span class="number">97</span> * v6 + v7 + <span class="number">-45</span> * v5 + <span class="number">84</span> * v4 + <span class="number">95</span> * v2 - <span class="number">20</span> * v1 + <span class="number">12</span> * v3 == <span class="number">12613</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    v11 = a1[<span class="number">9</span>];</span><br><span class="line">    <span class="keyword">if</span> ( <span class="number">30</span> * v11 + <span class="number">-70</span> * v9 + <span class="number">-122</span> * v6 + <span class="number">-81</span> * v7 + <span class="number">-66</span> * v5 + <span class="number">-115</span> * v4 + <span class="number">-41</span> * v3 + <span class="number">-86</span> * v1 - <span class="number">15</span> * v2 - <span class="number">30</span> * v8 == <span class="number">-54400</span></span><br><span class="line">      &amp;&amp; <span class="number">-103</span> * v11 + <span class="number">120</span> * v8 + <span class="number">108</span> * v7 + <span class="number">48</span> * v4 + <span class="number">-89</span> * v3 + <span class="number">78</span> * v1 - <span class="number">41</span> * v2 + <span class="number">31</span> * v5 - (v6 &lt;&lt; <span class="number">6</span>) - <span class="number">120</span> * v9 == <span class="number">-10283</span></span><br><span class="line">      &amp;&amp; <span class="number">71</span> * v6 + (v7 &lt;&lt; <span class="number">7</span>) + <span class="number">99</span> * v5 + <span class="number">-111</span> * v3 + <span class="number">85</span> * v1 + <span class="number">79</span> * v2 - <span class="number">30</span> * v4 - <span class="number">119</span> * v8 + <span class="number">48</span> * v9 - <span class="number">16</span> * v11 == <span class="number">22855</span></span><br><span class="line">      &amp;&amp; <span class="number">5</span> * v11 + <span class="number">23</span> * v9 + <span class="number">122</span> * v8 + <span class="number">-19</span> * v6 + <span class="number">99</span> * v7 + <span class="number">-117</span> * v5 + <span class="number">-69</span> * v3 + <span class="number">22</span> * v1 - <span class="number">98</span> * v2 + <span class="number">10</span> * v4 == <span class="number">-2944</span></span><br><span class="line">      &amp;&amp; <span class="number">-54</span> * v11 + <span class="number">-23</span> * v8 + <span class="number">-82</span> * v3 + <span class="number">-85</span> * v2 + <span class="number">124</span> * v1 - <span class="number">11</span> * v4 - <span class="number">8</span> * v5 - <span class="number">60</span> * v7 + <span class="number">95</span> * v6 + <span class="number">100</span> * v9 == <span class="number">-2222</span></span><br><span class="line">      &amp;&amp; <span class="number">-83</span> * v11 + <span class="number">-111</span> * v7 + <span class="number">-57</span> * v2 + <span class="number">41</span> * v1 + <span class="number">73</span> * v3 - <span class="number">18</span> * v4 + <span class="number">26</span> * v5 + <span class="number">16</span> * v6 + <span class="number">77</span> * v8 - <span class="number">63</span> * v9 == <span class="number">-13258</span></span><br><span class="line">      &amp;&amp; <span class="number">81</span> * v11 + <span class="number">-48</span> * v9 + <span class="number">66</span> * v8 + <span class="number">-104</span> * v6 + <span class="number">-121</span> * v7 + <span class="number">95</span> * v5 + <span class="number">85</span> * v4 + <span class="number">60</span> * v3 + <span class="number">-85</span> * v2 + <span class="number">80</span> * v1 == <span class="number">-1559</span></span><br><span class="line">      &amp;&amp; <span class="number">101</span> * v11 + <span class="number">-85</span> * v9 + <span class="number">7</span> * v6 + <span class="number">117</span> * v7 + <span class="number">-83</span> * v5 + <span class="number">-101</span> * v4 + <span class="number">90</span> * v3 + <span class="number">-28</span> * v1 + <span class="number">18</span> * v2 - v8 == <span class="number">6308</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      result = <span class="number">99</span> * v11 + <span class="number">-28</span> * v9 + <span class="number">5</span> * v8 + <span class="number">93</span> * v6 + <span class="number">-18</span> * v7 + <span class="number">-127</span> * v5 + <span class="number">6</span> * v4 + <span class="number">-9</span> * v3 + <span class="number">-93</span> * v1 + <span class="number">58</span> * v2 == <span class="number">-1697</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>需要注意的是它的v1和v2，v6和v7要换顺序，拿到输入的东西放入程序就能拿到第二段flag</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> z3 <span class="keyword">import</span> *</span><br><span class="line">v1, v2, v3, v4, v5, v6, v7, v8, v9, v11 = BitVecs(</span><br><span class="line">    <span class="string">&#x27;v1 v2 v3 v4 v5 v6 v7 v8 v9 v11&#x27;</span>, <span class="number">16</span>)</span><br><span class="line">s = Solver()</span><br><span class="line">s.add(v1 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v2 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v3 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v4 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v5 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v6 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v7 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v8 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v9 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(v11 &lt; <span class="number">128</span>)</span><br><span class="line">s.add(-<span class="number">85</span> * v9 + <span class="number">58</span> * v8 + <span class="number">97</span> * v6 + v7 + -<span class="number">45</span> * v5 +</span><br><span class="line">      <span class="number">84</span> * v4 + <span class="number">95</span> * v2 - <span class="number">20</span> * v1 + <span class="number">12</span> * v3 == <span class="number">12613</span>)</span><br><span class="line">s.add(<span class="number">30</span> * v11 + -<span class="number">70</span> * v9 + -<span class="number">122</span> * v6 + -<span class="number">81</span> * v7 + -<span class="number">66</span> * v5 + -</span><br><span class="line">      <span class="number">115</span> * v4 + -<span class="number">41</span> * v3 + -<span class="number">86</span> * v1 - <span class="number">15</span> * v2 - <span class="number">30</span> * v8 == -<span class="number">54400</span>)</span><br><span class="line">s.add(-<span class="number">103</span> * v11 + <span class="number">120</span> * v8 + <span class="number">108</span> * v7 + <span class="number">48</span> * v4 + -<span class="number">89</span> * v3 +</span><br><span class="line">      <span class="number">78</span> * v1 - <span class="number">41</span> * v2 + <span class="number">31</span> * v5 - (v6 &lt;&lt; <span class="number">6</span>) - <span class="number">120</span> * v9 == -<span class="number">10283</span>)</span><br><span class="line">s.add(<span class="number">71</span> * v6 + (v7 &lt;&lt; <span class="number">7</span>) + <span class="number">99</span> * v5 + -<span class="number">111</span> * v3 + <span class="number">85</span> * v1 +</span><br><span class="line">      <span class="number">79</span> * v2 - <span class="number">30</span> * v4 - <span class="number">119</span> * v8 + <span class="number">48</span> * v9 - <span class="number">16</span> * v11 == <span class="number">22855</span>)</span><br><span class="line">s.add(<span class="number">5</span> * v11 + <span class="number">23</span> * v9 + <span class="number">122</span> * v8 + -<span class="number">19</span> * v6 + <span class="number">99</span> * v7 + -</span><br><span class="line">      <span class="number">117</span> * v5 + -<span class="number">69</span> * v3 + <span class="number">22</span> * v1 - <span class="number">98</span> * v2 + <span class="number">10</span> * v4 == -<span class="number">2944</span>)</span><br><span class="line">s.add(-<span class="number">54</span> * v11 + -<span class="number">23</span> * v8 + -<span class="number">82</span> * v3 + -<span class="number">85</span> * v2 + <span class="number">124</span> * v1 -</span><br><span class="line">      <span class="number">11</span> * v4 - <span class="number">8</span> * v5 - <span class="number">60</span> * v7 + <span class="number">95</span> * v6 + <span class="number">100</span> * v9 == -<span class="number">2222</span>)</span><br><span class="line">s.add(-<span class="number">83</span> * v11 + -<span class="number">111</span> * v7 + -<span class="number">57</span> * v2 + <span class="number">41</span> * v1 + <span class="number">73</span> * v3 -</span><br><span class="line">      <span class="number">18</span> * v4 + <span class="number">26</span> * v5 + <span class="number">16</span> * v6 + <span class="number">77</span> * v8 - <span class="number">63</span> * v9 == -<span class="number">13258</span>)</span><br><span class="line">s.add(<span class="number">81</span> * v11 + -<span class="number">48</span> * v9 + <span class="number">66</span> * v8 + -<span class="number">104</span> * v6 + -<span class="number">121</span> * v7 +</span><br><span class="line">      <span class="number">95</span> * v5 + <span class="number">85</span> * v4 + <span class="number">60</span> * v3 + -<span class="number">85</span> * v2 + <span class="number">80</span> * v1 == -<span class="number">1559</span>)</span><br><span class="line">s.add(<span class="number">101</span> * v11 + -<span class="number">85</span> * v9 + <span class="number">7</span> * v6 + <span class="number">117</span> * v7 + -<span class="number">83</span> * v5 + -</span><br><span class="line">      <span class="number">101</span> * v4 + <span class="number">90</span> * v3 + -<span class="number">28</span> * v1 + <span class="number">18</span> * v2 - v8 == <span class="number">6308</span>)</span><br><span class="line">s.add(<span class="number">99</span> * v11 + -<span class="number">28</span> * v9 + <span class="number">5</span> * v8 + <span class="number">93</span> * v6 + -<span class="number">18</span> * v7 + -</span><br><span class="line">      <span class="number">127</span> * v5 + <span class="number">6</span> * v4 + -<span class="number">9</span> * v3 + -<span class="number">93</span> * v1 + <span class="number">58</span> * v2 == -<span class="number">1697</span>)</span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> s.check() == sat:</span><br><span class="line">    <span class="built_in">print</span>(s.model())</span><br><span class="line">v8 = <span class="number">55</span></span><br><span class="line">v1 = <span class="number">48</span></span><br><span class="line">v6 = <span class="number">95</span></span><br><span class="line">v4 = <span class="number">82</span></span><br><span class="line">v2 = <span class="number">70</span></span><br><span class="line">v3 = <span class="number">117</span></span><br><span class="line">v11 = <span class="number">64</span></span><br><span class="line">v5 = <span class="number">84</span></span><br><span class="line">v7 = <span class="number">121</span></span><br><span class="line">v9 = <span class="number">119</span></span><br><span class="line"><span class="built_in">print</span>(<span class="built_in">chr</span>(v2)+<span class="built_in">chr</span>(v1)+<span class="built_in">chr</span>(v3)+<span class="built_in">chr</span>(v4)+<span class="built_in">chr</span>(v5) +</span><br><span class="line">      <span class="built_in">chr</span>(v7)+<span class="built_in">chr</span>(v6)+<span class="built_in">chr</span>(v8)+<span class="built_in">chr</span>(v9)+<span class="built_in">chr</span>(v11))</span><br></pre></td></tr></table></figure>

<h1 id="0x20-WUSTCTF2020-level4-二叉树"><a href="#0x20-WUSTCTF2020-level4-二叉树" class="headerlink" title="0x20.[WUSTCTF2020]level4(二叉树)"></a>0x20.[WUSTCTF2020]level4(二叉树)</h1><p>64位elf的逆向，先运行下：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ ./attachment </span><br><span class="line">Practice my Data Structure code.....</span><br><span class="line">Typing....Struct.....char....*left....*right............emmmmm...OK!</span><br><span class="line">Traversal!</span><br><span class="line">Traversal <span class="built_in">type</span> 1:2f0t02T&#123;hcsiI_SwA__r7Ee&#125;</span><br><span class="line">Traversal <span class="built_in">type</span> 2:20f0Th&#123;2tsIS_icArE&#125;e7__w</span><br><span class="line">Traversal <span class="built_in">type</span> 3:    //type3(&amp;x[22]);   No way!</span><br></pre></td></tr></table></figure>

<p>ida:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Practice my Data Structure code.....&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Typing....Struct.....char....*left....*right............emmmmm...OK!&quot;</span>);</span><br><span class="line">  init();</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Traversal!&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Traversal type 1:&quot;</span>);</span><br><span class="line">  type1(byte_601290);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;\nTraversal type 2:&quot;</span>);</span><br><span class="line">  type2(byte_601290);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;\nTraversal type 3:&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;    //type3(&amp;x[22]);   No way!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(&amp;byte_400A37);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">init</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+Ch] [rbp-34h]</span></span><br><span class="line">  <span class="keyword">char</span> v2[<span class="number">40</span>]; <span class="comment">// [rsp+10h] [rbp-30h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+38h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">strcpy</span>(v2, <span class="string">&quot;I&#123;_&#125;Af2700ih_secTS2Et_wr&quot;</span>);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">23</span>; ++i )</span><br><span class="line">    x[<span class="number">24</span> * i] = v2[i];</span><br><span class="line">  qword_601298 = &amp;unk_6011E8;</span><br><span class="line">  qword_6011F0 = &amp;unk_601260;</span><br><span class="line">  qword_601268 = &amp;unk_6010F8;</span><br><span class="line">  qword_601100 = &amp;unk_601110;</span><br><span class="line">  qword_601108 = &amp;unk_601140;</span><br><span class="line">  qword_601270 = &amp;unk_601230;</span><br><span class="line">  qword_601238 = &amp;unk_601158;</span><br><span class="line">  qword_601240 = &amp;unk_601098;</span><br><span class="line">  qword_6010A0 = &amp;unk_601200;</span><br><span class="line">  qword_6010A8 = &amp;unk_601188;</span><br><span class="line">  qword_6011F8 = &amp;unk_601170;</span><br><span class="line">  qword_601178 = &amp;unk_6011B8;</span><br><span class="line">  qword_601180 = &amp;unk_6010B0;</span><br><span class="line">  qword_6010B8 = x;</span><br><span class="line">  qword_6010C0 = &amp;unk_601218;</span><br><span class="line">  qword_6012A0 = &amp;unk_601278;</span><br><span class="line">  qword_601280 = &amp;unk_6010E0;</span><br><span class="line">  qword_601288 = &amp;unk_6011A0;</span><br><span class="line">  qword_6011B0 = &amp;unk_601128;</span><br><span class="line">  qword_601130 = &amp;unk_6012A8;</span><br><span class="line">  qword_601138 = &amp;unk_6011D0;</span><br><span class="line">  qword_6011D8 = &amp;unk_601248;</span><br><span class="line">  qword_6011E0 = &amp;unk_6010C8;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>再看下type1和type2：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __fastcall <span class="title">type1</span><span class="params">(<span class="keyword">char</span> *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">if</span> ( a1 )</span><br><span class="line">  &#123;</span><br><span class="line">    type1(*(a1 + <span class="number">1</span>));</span><br><span class="line">    <span class="built_in">putchar</span>(*a1);</span><br><span class="line">    type1(*(a1 + <span class="number">2</span>));</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> __fastcall <span class="title">type2</span><span class="params">(<span class="keyword">char</span> *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">if</span> ( a1 )</span><br><span class="line">  &#123;</span><br><span class="line">    type2(*(a1 + <span class="number">1</span>));</span><br><span class="line">    type2(*(a1 + <span class="number">2</span>));</span><br><span class="line">    <span class="built_in">putchar</span>(*a1);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>就是二叉树的遍历（具体文章看这个：<a target="_blank" rel="noopener" href="https://blog.csdn.net/LX18792732127/article/details/76167482%EF%BC%89%EF%BC%8C%E4%B8%80%E5%85%B1%E6%9C%893%E7%A7%8D%EF%BC%88%E5%85%88%E5%BA%8F%E9%81%8D%E5%8E%86%EF%BC%8C%E5%90%8E%E5%BA%8F%E9%81%8D%E5%8E%86%EF%BC%8C%E4%B8%AD%E5%BA%8F%E9%81%8D%E5%8E%86%EF%BC%89%EF%BC%8C%E4%B8%8A%E9%9D%A2%E7%9A%84%E6%98%AF%E4%B8%AD%E5%BA%8F%E9%81%8D%E5%8E%86%E5%92%8C%E5%90%8E%E5%BA%8F%E9%81%8D%E5%8E%86%E3%80%82%E5%B7%AE%E4%B8%80%E4%B8%AA%E5%85%88%E5%BA%8F%E9%81%8D%E5%8E%86%EF%BC%8C%E4%BD%BF%E7%94%A8%E4%B8%AD%E5%BA%8F%E5%90%8E%E5%BA%8F%E6%B1%82%E5%85%88%E5%BA%8F%EF%BC%9A">https://blog.csdn.net/LX18792732127/article/details/76167482），一共有3种（先序遍历，后序遍历，中序遍历），上面的是中序遍历和后序遍历。差一个先序遍历，使用中序后序求先序：</a></p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">TreeNode</span>:</span></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">__init__</span>(<span class="params">self, x</span>):</span></span><br><span class="line">        self.val = x</span><br><span class="line">        self.left = <span class="literal">None</span></span><br><span class="line">        self.right = <span class="literal">None</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Solution</span>:</span></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">reConstructBinaryTree</span>(<span class="params">self, post, tin</span>):</span></span><br><span class="line">        <span class="keyword">if</span> <span class="built_in">len</span>(post) == <span class="number">0</span>:</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">None</span></span><br><span class="line">        root = TreeNode(post[-<span class="number">1</span>])</span><br><span class="line">        TinIndex = tin.index(post[-<span class="number">1</span>])</span><br><span class="line">        root.left = self.reConstructBinaryTree(</span><br><span class="line">            post[<span class="number">0</span>:TinIndex], tin[<span class="number">0</span>:TinIndex])</span><br><span class="line">        root.right = self.reConstructBinaryTree(</span><br><span class="line">            post[TinIndex:<span class="built_in">len</span>(post) - <span class="number">1</span>], tin[TinIndex + <span class="number">1</span>:])</span><br><span class="line">        <span class="keyword">return</span> root</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">PreTraversal</span>(<span class="params">self, root</span>):</span></span><br><span class="line">        <span class="keyword">if</span> root != <span class="literal">None</span>:</span><br><span class="line">            <span class="built_in">print</span>(root.val, end=<span class="string">&quot;&quot;</span>)</span><br><span class="line">            self.PreTraversal(root.left)</span><br><span class="line">            self.PreTraversal(root.right)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">strm = <span class="string">&quot;2f0t02T&#123;hcsiI_SwA__r7Ee&#125;&quot;</span></span><br><span class="line">stre = <span class="string">&quot;20f0Th&#123;2tsIS_icArE&#125;e7__w&quot;</span></span><br><span class="line">post = <span class="built_in">list</span>(stre)  <span class="comment"># 后序</span></span><br><span class="line">tin = <span class="built_in">list</span>(strm)  <span class="comment"># 中序</span></span><br><span class="line"></span><br><span class="line">S = Solution()</span><br><span class="line">root = S.reConstructBinaryTree(post, tin)</span><br><span class="line">S.PreTraversal(root)</span><br></pre></td></tr></table></figure>

<h1 id="0x21-网鼎杯-2020-青龙组-singal（vm逆向）"><a href="#0x21-网鼎杯-2020-青龙组-singal（vm逆向）" class="headerlink" title="0x21.[网鼎杯 2020 青龙组]singal（vm逆向）"></a>0x21.[网鼎杯 2020 青龙组]singal（vm逆向）</h1><blockquote>
<p>  VM逆向参考：<a target="_blank" rel="noopener" href="https://blog.csdn.net/weixin_43876357/article/details/108570305">https://blog.csdn.net/weixin_43876357/article/details/108570305</a></p>
</blockquote>
<p>看了wp知道这这类题目的名字：VM逆向：</p>
<p>主函数和关键函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> a1[<span class="number">117</span>]; <span class="comment">// [esp+18h] [ebp-1D4h] BYREF</span></span><br><span class="line"></span><br><span class="line">  __main();</span><br><span class="line">  qmemcpy(a1, &amp;asc_403040, <span class="number">0x1C8</span>u);</span><br><span class="line">  vm_operad(a1, <span class="string">&#x27;r&#x27;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;good,The answer format is:flag &#123;&#125;&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> __cdecl <span class="title">vm_operad</span><span class="params">(<span class="keyword">int</span> *str_local, <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> input[<span class="number">100</span>]; <span class="comment">// [esp+13h] [ebp-E5h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v3[<span class="number">100</span>]; <span class="comment">// [esp+77h] [ebp-81h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> v4; <span class="comment">// [esp+DBh] [ebp-1Dh]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [esp+DCh] [ebp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v6; <span class="comment">// [esp+E0h] [ebp-18h]</span></span><br><span class="line">  <span class="keyword">int</span> v7; <span class="comment">// [esp+E4h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// [esp+E8h] [ebp-10h]</span></span><br><span class="line">  <span class="keyword">int</span> v9; <span class="comment">// [esp+ECh] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v9 = <span class="number">0</span>;</span><br><span class="line">  v8 = <span class="number">0</span>;</span><br><span class="line">  v7 = <span class="number">0</span>;</span><br><span class="line">  v6 = <span class="number">0</span>;</span><br><span class="line">  v5 = <span class="number">0</span>;</span><br><span class="line">LABEL_2:</span><br><span class="line">  <span class="keyword">while</span> ( v9 &lt; a2 )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">switch</span> ( str_local[v9] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">        v3[v6] = v4;</span><br><span class="line">        ++v9;</span><br><span class="line">        ++v6;</span><br><span class="line">        ++v8;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">        v4 = str_local[v9 + <span class="number">1</span>] + input[v8];</span><br><span class="line">        v9 += <span class="number">2</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">        v4 = input[v8] - LOBYTE(str_local[v9 + <span class="number">1</span>]);</span><br><span class="line">        v9 += <span class="number">2</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">4</span>:</span><br><span class="line">        v4 = str_local[v9 + <span class="number">1</span>] ^ input[v8];</span><br><span class="line">        v9 += <span class="number">2</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">5</span>:</span><br><span class="line">        v4 = str_local[v9 + <span class="number">1</span>] * input[v8];</span><br><span class="line">        v9 += <span class="number">2</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">6</span>:</span><br><span class="line">        ++v9;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">7</span>:</span><br><span class="line">        <span class="keyword">if</span> ( v3[v7] != str_local[v9 + <span class="number">1</span>] )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">printf</span>(<span class="string">&quot;what a shame...&quot;</span>);</span><br><span class="line">          <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        ++v7;</span><br><span class="line">        v9 += <span class="number">2</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">8</span>:</span><br><span class="line">        input[v5] = v4;</span><br><span class="line">        ++v9;</span><br><span class="line">        ++v5;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">10</span>:</span><br><span class="line">        read(input);</span><br><span class="line">        ++v9;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">11</span>:</span><br><span class="line">        v4 = input[v8] - <span class="number">1</span>;</span><br><span class="line">        ++v9;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">12</span>:</span><br><span class="line">        v4 = input[v8] + <span class="number">1</span>;</span><br><span class="line">        ++v9;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">default</span>:</span><br><span class="line">        <span class="keyword">goto</span> LABEL_2;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>仔细看下operad的操作：</p>
<p>case7当不等的时候直接退出，v3由v4得出，v4由输入的input和本地的local_str经过运算得出。</p>
<p>input–&gt;v4—&gt;v3，所以我们要根据local_str算出v3，然后算v4，最后flag。</p>
<p>case10的时候输入的是固定长度15.</p>
<p>输出看下与localstr比较的是那些index，并且记录每次index的值（包括没有比较的index</p>
<p>所以：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;Windows.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">void</span> __cdecl <span class="title">read</span><span class="params">(<span class="keyword">char</span> *Str)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;string:&quot;</span>);</span><br><span class="line">    <span class="built_in">scanf</span>(<span class="string">&quot;%s&quot;</span>, Str);</span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strlen</span>(Str) != <span class="number">15</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;WRONG!\n&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> __cdecl <span class="title">vm_operad</span><span class="params">(<span class="keyword">int</span> *str_local, <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">char</span> order[<span class="number">114</span>] = &#123;&#125;;</span><br><span class="line">    <span class="keyword">char</span> input[<span class="number">100</span>]; <span class="comment">// [esp+13h] [ebp-E5h] BYREF</span></span><br><span class="line">    <span class="keyword">char</span> v3[<span class="number">100</span>];    <span class="comment">// [esp+77h] [ebp-81h] BYREF</span></span><br><span class="line">    <span class="keyword">char</span> v4;         <span class="comment">// [esp+DBh] [ebp-1Dh]</span></span><br><span class="line">    <span class="keyword">int</span> v5;          <span class="comment">// [esp+DCh] [ebp-1Ch]</span></span><br><span class="line">    <span class="keyword">int</span> v6;          <span class="comment">// [esp+E0h] [ebp-18h]</span></span><br><span class="line">    <span class="keyword">int</span> v7;          <span class="comment">// [esp+E4h] [ebp-14h]</span></span><br><span class="line">    <span class="keyword">int</span> v8;          <span class="comment">// [esp+E8h] [ebp-10h]</span></span><br><span class="line">    <span class="keyword">int</span> v9;          <span class="comment">// [esp+ECh] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">    v9 = <span class="number">0</span>;</span><br><span class="line">    v8 = <span class="number">0</span>;</span><br><span class="line">    v7 = <span class="number">0</span>;</span><br><span class="line">    v6 = <span class="number">0</span>;</span><br><span class="line">    v5 = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">int</span> s = <span class="number">0</span>;</span><br><span class="line">LABEL_2:</span><br><span class="line">    <span class="keyword">while</span> (v9 &lt; a2)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="keyword">switch</span> (str_local[v9])</span><br><span class="line">        &#123;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">            v3[v6] = v4;</span><br><span class="line">            ++v9;</span><br><span class="line">            ++v6;</span><br><span class="line">            ++v8;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">            v4 = str_local[v9 + <span class="number">1</span>] + input[v8];</span><br><span class="line">            v9 += <span class="number">2</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">            v4 = input[v8] - LOBYTE(str_local[v9 + <span class="number">1</span>]);</span><br><span class="line">            v9 += <span class="number">2</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">4</span>:</span><br><span class="line">            v4 = str_local[v9 + <span class="number">1</span>] ^ input[v8];</span><br><span class="line">            v9 += <span class="number">2</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">5</span>:</span><br><span class="line">            v4 = str_local[v9 + <span class="number">1</span>] * input[v8];</span><br><span class="line">            v9 += <span class="number">2</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">6</span>:</span><br><span class="line">            ++v9;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">7</span>:</span><br><span class="line">            v3[v7] = str_local[v9 + <span class="number">1</span>];</span><br><span class="line">            <span class="built_in">printf</span>(<span class="string">&quot;%#x,&quot;</span>, v3[v7]);</span><br><span class="line">            ++v7;</span><br><span class="line">            v9 += <span class="number">2</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">8</span>:</span><br><span class="line">            input[v5] = v4;</span><br><span class="line">            ++v9;</span><br><span class="line">            ++v5;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">10</span>:</span><br><span class="line">            read(input);</span><br><span class="line">            ++v9;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">11</span>:</span><br><span class="line">            v4 = input[v8] - <span class="number">1</span>;</span><br><span class="line">            ++v9;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">case</span> <span class="number">12</span>:</span><br><span class="line">            v4 = input[v8] + <span class="number">1</span>;</span><br><span class="line">            ++v9;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        <span class="keyword">default</span>:</span><br><span class="line">            <span class="keyword">goto</span> LABEL_2;</span><br><span class="line">        &#125;</span><br><span class="line">        order[s++] = v9;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;\n顺序:\n&quot;</span>);</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">int</span> ss = <span class="number">0</span>; ss &lt; <span class="built_in">strlen</span>(order); ss++)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;%x, &quot;</span>, order[ss]);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">char</span> ida_chars[] =</span><br><span class="line">        &#123;</span><br><span class="line">            <span class="number">0x0A</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x10</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x05</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x20</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x05</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0B</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0C</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x05</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x21</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0B</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0B</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x09</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x20</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x51</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x24</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x0C</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0B</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x05</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x02</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x25</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x36</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x41</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x20</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x05</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x05</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x25</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x04</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x09</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x03</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x20</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x02</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x41</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x08</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x0C</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x01</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x22</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x3F</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x34</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x32</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x72</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x33</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x18</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0xA7</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>,</span><br><span class="line">            <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x31</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0xF1</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x28</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x84</span>, <span class="number">0xFF</span>,</span><br><span class="line">            <span class="number">0xFF</span>, <span class="number">0xFF</span>, <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0xC1</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>, <span class="number">0xFF</span>,</span><br><span class="line">            <span class="number">0x07</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x1E</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x07</span>, <span class="number">0x00</span>,</span><br><span class="line">            <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x7A</span>, <span class="number">0x00</span>, <span class="number">0x00</span>, <span class="number">0x00</span>&#125;;</span><br><span class="line">    <span class="keyword">int</span> *str = (<span class="keyword">int</span> *)ida_chars;</span><br><span class="line">    <span class="comment">// for (int i = 0; i &lt; 100; i++)</span></span><br><span class="line">    <span class="comment">// &#123;</span></span><br><span class="line">    <span class="comment">//     printf(&quot;%d &quot;, str[i]);</span></span><br><span class="line">    <span class="comment">// &#125;</span></span><br><span class="line">    vm_operad(str, <span class="number">114</span>);</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>得到：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">0x22 0x3f 0x34 0x32 0x72 0x33 0x18 0xffffffa7 0x31 0xfffffff1 0x28 0xffffff84 0xffffffc1 0x1e 0x7a </span><br><span class="line">顺序:</span><br><span class="line">1, 3, 4, 6, 7, 9, 10, 12, 13, 15, 16, 17, 18, 19, 20, 22, 23, 25, 26, 28, 29, 30, 31, 32, 33, 35, 36, 38, 39, 41, 42, 44, 45, 46, 47, 48, 49, 51, 52, 54, 55, 57, 58, </span><br><span class="line">60, 61, 63, 64, 66, 67, 69, 70, 72, 73, 75, 76, 78, 79, 81, 82, 83, 84, 86, 88, 90, 92, 94, 96, 98, 100, 102, 104, 106, 108, 110, 112, 114,</span><br></pre></td></tr></table></figure>

<p>正好比较了15次。</p>
<p>现在知道了执行顺序以及有关flag的关键信息。逆着走一遍就好：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">vm_decode</span><span class="params">(<span class="keyword">int</span> *opcode,<span class="keyword">int</span> len_114)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> order[<span class="number">100</span>] = &#123;<span class="number">1</span>, <span class="number">3</span>, <span class="number">4</span>, <span class="number">6</span>, <span class="number">7</span>, <span class="number">9</span>, <span class="number">10</span>, <span class="number">12</span>, <span class="number">13</span>, <span class="number">15</span>, <span class="number">16</span>, <span class="number">17</span>, <span class="number">18</span>, <span class="number">19</span>, <span class="number">20</span>, <span class="number">22</span>, <span class="number">23</span>, <span class="number">25</span>, <span class="number">26</span>, <span class="number">28</span>, <span class="number">29</span>, <span class="number">30</span>, <span class="number">31</span>, <span class="number">32</span>, <span class="number">33</span>, <span class="number">35</span>, <span class="number">36</span>, <span class="number">38</span>, <span class="number">39</span>, <span class="number">41</span>, <span class="number">42</span>, <span class="number">44</span>, <span class="number">45</span>, <span class="number">46</span>, <span class="number">47</span>, <span class="number">48</span>, <span class="number">49</span>, <span class="number">51</span>, <span class="number">52</span>, <span class="number">54</span>, <span class="number">55</span>, <span class="number">57</span>, <span class="number">58</span>, <span class="number">60</span>, <span class="number">61</span>, <span class="number">63</span>, <span class="number">64</span>, <span class="number">66</span>, <span class="number">67</span>, <span class="number">69</span>, <span class="number">70</span>, <span class="number">72</span>, <span class="number">73</span>, <span class="number">75</span>, <span class="number">76</span>, <span class="number">78</span>, <span class="number">79</span>, <span class="number">81</span>, <span class="number">82</span>, <span class="number">83</span>, <span class="number">84</span>, <span class="number">86</span>, <span class="number">88</span>, <span class="number">90</span>, <span class="number">92</span>, <span class="number">94</span>, <span class="number">96</span>, <span class="number">98</span>, <span class="number">100</span>, <span class="number">102</span>, <span class="number">104</span>, <span class="number">106</span>, <span class="number">108</span>, <span class="number">110</span>, <span class="number">112</span>, <span class="number">114</span>&#125;;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">char</span> v4[] = &#123;<span class="number">0x22</span>, <span class="number">0x3f</span>, <span class="number">0x34</span>, <span class="number">0x32</span>, <span class="number">0x72</span>, <span class="number">0x33</span>, <span class="number">0x18</span>, <span class="number">0xffffffa7</span>, <span class="number">0x31</span>, <span class="number">0xfffffff1</span>, <span class="number">0x28</span>, <span class="number">0xffffff84</span>, <span class="number">0xffffffc1</span>, <span class="number">0x1e</span>, <span class="number">0x7a</span>&#125;;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">char</span> flag[<span class="number">100</span>] = &#123;&#125;; <span class="comment">// [esp+13h] [ebp-E5h]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [esp+DBh] [ebp-1Dh]</span></span><br><span class="line">  <span class="keyword">int</span> m; <span class="comment">// [esp+DCh] [ebp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> z; <span class="comment">// [esp+E0h] [ebp-18h]</span></span><br><span class="line">  <span class="keyword">int</span> x; <span class="comment">// [esp+E8h] [ebp-10h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+ECh] [ebp-Ch]</span></span><br><span class="line">  x = <span class="number">15</span>;</span><br><span class="line">  z = <span class="number">15</span>;</span><br><span class="line">  m = <span class="number">15</span>;</span><br><span class="line">  <span class="keyword">for</span>(<span class="keyword">int</span> k=<span class="built_in">strlen</span>(order) - <span class="number">1</span>;k&gt;=<span class="number">0</span>;k--)<span class="comment">//从后往前</span></span><br><span class="line">  &#123;</span><br><span class="line">	i = order[k];</span><br><span class="line">    <span class="keyword">switch</span> ( opcode[i] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">		--x;</span><br><span class="line">		--z;</span><br><span class="line">        v5 = v4[z];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">        flag[x] = v5 - opcode[i + <span class="number">1</span>];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">        flag[x] = v5 + opcode[i + <span class="number">1</span>];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">4</span>:</span><br><span class="line">        flag[x] = v5 ^ opcode[i + <span class="number">1</span>];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">5</span>:</span><br><span class="line">        flag[x] = v5 / opcode[i + <span class="number">1</span>];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">6</span>:</span><br><span class="line">		<span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">8</span>:</span><br><span class="line">        v5 = flag[--m];</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">11</span>:</span><br><span class="line">        flag[x] = v5 + <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">12</span>:</span><br><span class="line">        flag[x] = v5 - <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>,flag);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>太不熟了。。</p>
<h1 id="0x22-firmware"><a href="#0x22-firmware" class="headerlink" title="0x22.firmware"></a>0x22.firmware</h1><p>binwalk提取</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">┌──(kali㉿kali)-[~/Desktop]</span><br><span class="line">└─$ binwalk -e 51475f91-7b90-41dd-81a3-8b82df4f29d0.bin </span><br><span class="line"></span><br><span class="line">DECIMAL       HEXADECIMAL     DESCRIPTION</span><br><span class="line">--------------------------------------------------------------------------------</span><br><span class="line">0             0x0             TP-Link firmware header, firmware version: 1.-20432.3, image version: <span class="string">&quot;&quot;</span>, product ID: 0x0, product version: 155254791, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 4063744, kernel length: 512, rootfs offset: 772784, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0</span><br><span class="line">69424         0x10F30         Certificate <span class="keyword">in</span> DER format (x509 v3), header length: 4, sequence length: 64</span><br><span class="line">94080         0x16F80         U-Boot version string, <span class="string">&quot;U-Boot 1.1.4 (Aug 26 2013 - 09:07:51)&quot;</span></span><br><span class="line">94256         0x17030         CRC32 polynomial table, big endian</span><br><span class="line">131584        0x20200         TP-Link firmware header, firmware version: 0.0.3, image version: <span class="string">&quot;&quot;</span>, product ID: 0x0, product version: 155254791, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 3932160, kernel length: 512, rootfs offset: 772784, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0</span><br><span class="line">132096        0x20400         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2203728 bytes</span><br><span class="line"></span><br><span class="line">WARNING: Extractor.execute failed to run external extractor <span class="string">&#x27;sasquatch -p 1 -le -d &#x27;</span>squashfs-root<span class="string">&#x27; &#x27;</span>%e<span class="string">&#x27;&#x27;</span>: [Errno 2] No such file or directory: <span class="string">&#x27;sasquatch&#x27;</span>, <span class="string">&#x27;sasquatch -p 1 -le -d &#x27;</span>squashfs-root<span class="string">&#x27; &#x27;</span>%e<span class="string">&#x27;&#x27;</span> might not be installed correctly</span><br><span class="line"></span><br><span class="line">WARNING: Extractor.execute failed to run external extractor <span class="string">&#x27;sasquatch -p 1 -be -d &#x27;</span>squashfs-root<span class="string">&#x27; &#x27;</span>%e<span class="string">&#x27;&#x27;</span>: [Errno 2] No such file or directory: <span class="string">&#x27;sasquatch&#x27;</span>, <span class="string">&#x27;sasquatch -p 1 -be -d &#x27;</span>squashfs-root<span class="string">&#x27; &#x27;</span>%e<span class="string">&#x27;&#x27;</span> might not be installed correctly</span><br><span class="line">1180160       0x120200        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2774624 bytes, 519 inodes, blocksize: 131072 bytes, created: 2015-04-13 09:35:04</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>几个文件，其中</p>
<blockquote>
<p>  SquashFS 是一套基于Linux内核使用的压缩只读文件系统</p>
</blockquote>
<p>需要用到 <strong>firmware-mod-kit</strong>解压，安装方法：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">sudo apt-get install git build-essential zlib1g-dev liblzma-dev python-magic</span><br><span class="line">git <span class="built_in">clone</span> https://github.com/mirror/firmware-mod-kit.git</span><br><span class="line"><span class="built_in">cd</span> firmware-mod-kit/src</span><br><span class="line">./configure &amp;&amp; make</span><br></pre></td></tr></table></figure>

<p>解压文件系统：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop/_51475f91-7b90-41dd-81a3-8b82df4f29d0.bin.extracted$ /home/gwt/firmware-mod-kit/unsquashfs_all.sh  120200.squashfs </span><br><span class="line">/home/gwt/firmware-mod-kit/unsquashfs_all.sh: line 85: ./src/binwalk: No such file or directory</span><br><span class="line">Attempting to extract SquashFS .X file system...</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">Trying ./src/squashfs-2.1-r2/unsquashfs... </span><br><span class="line">Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... </span><br><span class="line">Trying ./src/squashfs-3.0/unsquashfs... </span><br><span class="line">Trying ./src/squashfs-3.0/unsquashfs-lzma... </span><br><span class="line">Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... </span><br><span class="line">Trying ./src/others/squashfs-2.0-nb4/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.0-e2100/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... </span><br><span class="line">Trying ./src/others/squashfs-3.2-r2/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.3/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.4-cisco/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.4-nb4/unsquashfs... </span><br><span class="line">Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... </span><br><span class="line">Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 1 processor</span><br><span class="line"></span><br><span class="line">Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 1 processor</span><br><span class="line"></span><br><span class="line">Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 1 processor</span><br><span class="line">480 inodes (523 blocks) to write</span><br><span class="line"></span><br><span class="line">[==================================================================================================-               ] 454/523  86%</span><br><span class="line">created 341 files</span><br><span class="line">created 39 directories</span><br><span class="line">created 70 symlinks</span><br><span class="line">created 0 devices</span><br><span class="line">created 0 fifos</span><br><span class="line">File system sucessfully extracted!</span><br><span class="line">MKFS=<span class="string">&quot;./src/others/squashfs-4.0-lzma/mksquashfs-lzma&quot;</span></span><br></pre></td></tr></table></figure>

<p>找到backdoor文件，去upx壳，然后直接找到：<code>echo.byethost51.com:36667</code></p>
<h1 id="0x23-GUET-CTF2019-number-game-未完，记得动调"><a href="#0x23-GUET-CTF2019-number-game-未完，记得动调" class="headerlink" title="0x23.[GUET-CTF2019]number_game(未完，记得动调)"></a>0x23.[GUET-CTF2019]number_game(未完，记得动调)</h1><p>先看了下流程：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 v4; <span class="comment">// [rsp+8h] [rbp-38h]</span></span><br><span class="line">  __int64 v5; <span class="comment">// [rsp+10h] [rbp-30h] BYREF</span></span><br><span class="line">  __int16 v6; <span class="comment">// [rsp+18h] [rbp-28h]</span></span><br><span class="line">  __int64 v7; <span class="comment">// [rsp+20h] [rbp-20h] BYREF</span></span><br><span class="line">  __int16 v8; <span class="comment">// [rsp+28h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">char</span> v9; <span class="comment">// [rsp+2Ah] [rbp-16h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v10; <span class="comment">// [rsp+38h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v10 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  v5 = <span class="number">0LL</span>;</span><br><span class="line">  v6 = <span class="number">0</span>;</span><br><span class="line">  v7 = <span class="number">0LL</span>;</span><br><span class="line">  v8 = <span class="number">0</span>;</span><br><span class="line">  v9 = <span class="number">0</span>;</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%s&quot;</span>, &amp;v5);</span><br><span class="line">  <span class="keyword">if</span> ( sub_4006D6(&amp;v5) )</span><br><span class="line">  &#123;</span><br><span class="line">    v4 = sub_400758(&amp;v5, <span class="number">0LL</span>, <span class="number">10LL</span>);</span><br><span class="line">    sub_400807(v4, &amp;v7);</span><br><span class="line">    v9 = <span class="number">0</span>;</span><br><span class="line">    sub_400881(&amp;v7);</span><br><span class="line">    <span class="keyword">if</span> ( sub_400917() )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;TQL!&quot;</span>);</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;flag&#123;&quot;</span>);</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>, &amp;v5);</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;&#125;&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;your are cxk!!&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v10;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>经过了几次变换，重要的是这个：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">sub_400917</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v1; <span class="comment">// [rsp+0h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+4h] [rbp-Ch]</span></span><br><span class="line">  <span class="keyword">int</span> j; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> k; <span class="comment">// [rsp+Ch] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  v1 = <span class="number">1</span>;</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">4</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">for</span> ( j = <span class="number">0</span>; j &lt;= <span class="number">4</span>; ++j )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">for</span> ( k = j + <span class="number">1</span>; k &lt;= <span class="number">4</span>; ++k )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( *(&amp;byte_601060 + <span class="number">5</span> * i + j) == *(&amp;byte_601060 + <span class="number">5</span> * i + k) )</span><br><span class="line">          v1 = <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">if</span> ( *(&amp;byte_601060 + <span class="number">5</span> * j + i) == *(&amp;byte_601060 + <span class="number">5</span> * k + i) )</span><br><span class="line">          v1 = <span class="number">0</span>;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> v1;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>应该是个5*5的东西，发现了：<code>14#2330#1#0#23##3##042##1</code></p>
<p>是和数独差不多的东西</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">14#23</span><br><span class="line">30#1#</span><br><span class="line">0#23#</span><br><span class="line">#3##0</span><br><span class="line">42##1</span><br></pre></td></tr></table></figure>

<p>看了好多wp终于看懂了，他上面的判断只是判断了每一行和每一列不能有相同的而已，so：<code>0 4 2 1 4 2 1 4 3 0</code> </p>
<p>输出0123456789动调下（这个等明天调，<a target="_blank" rel="noopener" href="https://blog.csdn.net/Palmer9/article/details/104613420%EF%BC%89%EF%BC%8C%EF%BC%88%E6%88%96%E8%80%85%E5%8F%AF%E4%BB%A5%E6%A0%B9%E6%8D%AE%E4%BB%A5%E4%B8%8A%E7%9A%84%E4%BB%A3%E7%A0%81%E7%9C%8B%E5%87%BA%EF%BC%89">https://blog.csdn.net/Palmer9/article/details/104613420），（或者可以根据以上的代码看出）</a></p>
<p>得到：0123456789 —&gt; 7381940526，最后exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">model = [<span class="number">7</span>, <span class="number">3</span>, <span class="number">8</span>, <span class="number">1</span>, <span class="number">9</span>, <span class="number">4</span>, <span class="number">0</span>, <span class="number">5</span>, <span class="number">2</span>, <span class="number">6</span>]</span><br><span class="line">s = [<span class="number">48</span>, <span class="number">52</span>, <span class="number">50</span>, <span class="number">49</span>, <span class="number">52</span>, <span class="number">50</span>, <span class="number">49</span>, <span class="number">52</span>, <span class="number">51</span>, <span class="number">48</span>]</span><br><span class="line">flag = [<span class="number">0</span>] * <span class="number">10</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">10</span>):</span><br><span class="line">    flag[model[i]] = <span class="built_in">chr</span>(s[i])</span><br><span class="line">flag = <span class="string">&#x27;&#x27;</span>.join(flag)</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>

<h1 id="0x24-特殊的-BASE64"><a href="#0x24-特殊的-BASE64" class="headerlink" title="0x24.特殊的 BASE64"></a>0x24.特殊的 BASE64</h1><p>无壳，变表base64</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> base64</span><br><span class="line"><span class="keyword">import</span> string</span><br><span class="line"></span><br><span class="line">str1 = <span class="string">&quot;mTyqm7wjODkrNLcWl0eqO8K8gc1BPk1GNLgUpI==&quot;</span></span><br><span class="line"></span><br><span class="line">string1 = <span class="string">&quot;AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz0987654321+/&quot;</span></span><br><span class="line">string2 = <span class="string">&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(base64.b64decode(str1.translate(<span class="built_in">str</span>.maketrans(string1, string2))))</span><br></pre></td></tr></table></figure>


                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-11-07
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/RE/" title="RE">
              <b>#</b> RE
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/11/15/%E9%99%87%E5%8E%9F%E6%88%98%E7%96%AB2021%E9%83%A8%E5%88%86wp/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#0x01-%E7%AE%80%E5%8D%95%E6%B3%A8%E5%86%8C%E5%99%A8"><span class="toc-text">0x01.简单注册器</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x02-Java%E9%80%86%E5%90%91%E8%A7%A3%E5%AF%86"><span class="toc-text">0x02.Java逆向解密</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x03-findit"><span class="toc-text">0x03.findit</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x04-GWCTF-2019-pyre"><span class="toc-text">0x04.[GWCTF 2019]pyre</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x05-ACTF%E6%96%B0%E7%94%9F%E8%B5%9B2020-easyre"><span class="toc-text">0x05.[ACTF新生赛2020]easyre</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x06-rsa"><span class="toc-text">0x06.rsa</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x07-ACTF%E6%96%B0%E7%94%9F%E8%B5%9B2020-rome"><span class="toc-text">0x07.[ACTF新生赛2020]rome</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x08-2019%E7%BA%A2%E5%B8%BD%E6%9D%AF-easyRE"><span class="toc-text">0x08.[2019红帽杯]easyRE</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x09-FlareOn4-login"><span class="toc-text">0x09.[FlareOn4]login</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0A-GUET-CTF2019-re"><span class="toc-text">0x0A.[GUET-CTF2019]re</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0B-SUCTF2019-SignIn"><span class="toc-text">0x0B.[SUCTF2019]SignIn</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0C-Youngter-drive"><span class="toc-text">0x0C.Youngter-drive</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0D-WUSTCTF2020-level1"><span class="toc-text">0x0D.[WUSTCTF2020]level1</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0E-ACTF%E6%96%B0%E7%94%9F%E8%B5%9B2020-usualCrypt"><span class="toc-text">0x0E.[ACTF新生赛2020]usualCrypt</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x0F-MRCTF2020-Transform"><span class="toc-text">0x0F.[MRCTF2020]Transform</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x10-%E7%9B%B8%E5%86%8C"><span class="toc-text">0x10.相册</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x11-WUSTCTF2020-level2"><span class="toc-text">0x11.[WUSTCTF2020]level2</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x12-HDCTF2019-Maze"><span class="toc-text">0x12.[HDCTF2019]Maze</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0X13-GWCTF-2019-xxor%EF%BC%88%E6%9C%AA%E5%AE%8C%EF%BC%89"><span class="toc-text">0X13.[GWCTF 2019]xxor（未完）</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x14-MRCTF2020-Xor"><span class="toc-text">0x14.[MRCTF2020]Xor</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x15-FlareOn4-IgniteMe"><span class="toc-text">0x15.[FlareOn4]IgniteMe</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x16-MRCTF2020-hello-world-go"><span class="toc-text">0x16.[MRCTF2020]hello_world_go</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x17-WUSTCTF2020-level3"><span class="toc-text">0x17.[WUSTCTF2020]level3</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x18-WUSTCTF2020-Cr0ssfun"><span class="toc-text">0x18.[WUSTCTF2020]Cr0ssfun</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x19-FlareOn6-Overlong"><span class="toc-text">0x19.[FlareOn6]Overlong</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1A-BJDCTF2020-BJD-hamburger-competition"><span class="toc-text">0x1A.[BJDCTF2020]BJD hamburger competition</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1B-ACTF%E6%96%B0%E7%94%9F%E8%B5%9B2020-Oruga"><span class="toc-text">0x1B.[ACTF新生赛2020]Oruga</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1C-FlareOn3-Challenge1"><span class="toc-text">0x1C.[FlareOn3]Challenge1</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1D-Zer0pts2020-easy-strcmp"><span class="toc-text">0x1D.[Zer0pts2020]easy strcmp</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1E-UTCTF2020-basic-re"><span class="toc-text">0x1E.[UTCTF2020]basic-re</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x1F-ACTF%E6%96%B0%E7%94%9F%E8%B5%9B2020-Universe-final-answer"><span class="toc-text">0x1F.[ACTF新生赛2020]Universe_final_answer</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x20-WUSTCTF2020-level4-%E4%BA%8C%E5%8F%89%E6%A0%91"><span class="toc-text">0x20.[WUSTCTF2020]level4(二叉树)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x21-%E7%BD%91%E9%BC%8E%E6%9D%AF-2020-%E9%9D%92%E9%BE%99%E7%BB%84-singal%EF%BC%88vm%E9%80%86%E5%90%91%EF%BC%89"><span class="toc-text">0x21.[网鼎杯 2020 青龙组]singal（vm逆向）</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x22-firmware"><span class="toc-text">0x22.firmware</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x23-GUET-CTF2019-number-game-%E6%9C%AA%E5%AE%8C%EF%BC%8C%E8%AE%B0%E5%BE%97%E5%8A%A8%E8%B0%83"><span class="toc-text">0x23.[GUET-CTF2019]number_game(未完，记得动调)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x24-%E7%89%B9%E6%AE%8A%E7%9A%84-BASE64"><span class="toc-text">0x24.特殊的 BASE64</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_RE%E5%88%B7%E9%A2%98 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F11%2F07%2FBUU-RE-0x01-0x1F%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/11/07/BUU-RE-0x01-0x1F/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
